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(54) Controller having a fail safe function, automatic train controller, and system using the same 



(57) The object of the present invention is to provide 
a controller and a system having a highly reliable fail 
safe function. An ATP device which generates control 
data for the two systems from an ATP command speed 
signal, duplicates the logic unit in the ATP device so as 
to process each control data, provides at least two CRC 
data for checking the control data for each system, and 
changes the CRC data of the opposite logic units or se- 



FIG. 18 



lects one of the two according to the content of a failure 
detection signal from each of the duplicated logic units. 
It is realized to check the control data and the operation 
of each logic circuit and only when all the data, circuits, 
and elements operate normally, an output signal for con* 
trolling the object to be controlled is outputted and when 
a failure is detected in a part, an output signal is output- 
ted. Therefore, when a failure occurs, a fail safe function 
for controlling on the safety side is made possible. 
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:r Description •• a;, -j?'-', :V V ; S- V.?-T^y^rSv^ 

[0001] The present invention relates to a circuit hav- 
ing a fail safe function and a controller and system using 
it and particularly to train control systems such as an 
ATP (automatic train protection) device having a fail safe 
function suited to a train maintenance system, an ATS 
(automatic train stop) device f and an ATO (automatic 
train operation) device.and a controller and system us- 
ing them. 

[0002] As the electronic technology has been devel- 
oped recently, advanced and complicated control has 
been required so as to improve the energy (fuel) effi- 
ciency, operability, comfortability to ride in, and safety 
and to increase the speed in transport facilities such as is 
airplane, train, and automobile. 

[0003] On the other hand, a safety operation is nec- 
essary in those transport facilities and the reliability and 
fail safety (when a failure occurs, it is necessary that no 
output is routed from the dangerous side) of a controller 20 
are strongly required. - 

[0004] For example, the safety of a train operation is 
ensured by a superior maintenance system such as an 
ATC device and an ATS device. 

[0005] As shown in an example of an ATP device used 25 
in the maintenance system of super-express trains, the 
reliability and fail safety are appreciated both at home 
and abroad. 

[0006] An ATP device and an ATS device of those 
trains comprise a control circuit and relay including LSIs 30 
having a self check function mainly. A main signal used 
in those devices is afrequency signal in which the logical 
level is changed to H or L alternately (hereinafter called 
an alternating signal). 

[0007] The control circuit compares and processes an 35 
ATP speed command signal from the ground and an ac- 
tual speed signal of a train when it receives this ATP 
signal, controls the braking force by a speed control sig- 
nal, that is, a brake command signal according to the 
deviation between the ATC signal and the actual speed 40 
signal, and controls the speed of the train. 
[0008] A device for generating such an alternating sig- 
nal is described in Japanese Patent Application Laid- 
Open 57-62702. 

Lately, a system for transferring information on a train 45 
operation (for example, the speed and position of a train) 
between the central control command room and a train 
and exchanging information between trains is under 
construction so as to improve transport services and 
control of a higher density train operation and a higher so 
speed train operation are required. 
[0009] To respond to these requests, the controller in 
use at present and LSIs used for it alone are deficient 
in the functions of processing speed and data storage 
capacity and to make up for them, it is necessary to add 55 
many peripheral circuits and hence the controller is 
complicated. 

[0010] Since the technology of semiconductors has 



made remarkable progress recently and high integration 
and high speed have been realized, a control circuit hav- 
ing various functions can comprise one chip of LSf. 
[0011] However, in an LSI structured like this, there is 
a problem imposed that a wrong control signal due to 
mixed contact between the conductors formed inside it 
is outputted or a signal induced via a spray capacity be- 
tween a disconnected conductor and its adjacent con- 
ductor is outputted and a control signal which can be 
seen as if it is normal is outputted though the LSI itself 
is damaged. 

[0012] Furthermore, the use environment of an LSI for 
train control is extremely severe compared with that of 
an LSI for public welfare. 

[0013] A serious problem arises that when a wrong 
signal is outputted due to internal mixed contact or dis- 
connection during manufacture of an LSI or due to in- 
ternal mixed contact or disconnection during use or a 
brake command signal which is a main point of speed 
control is not outputted, a serious accident is caused. 
[001 4] It is necessary that an LS I corresponding to fu- 
ture various controls constitutes a control circuit which 
satisfies the functions corresponding to those controls, 
improves the self check function for detecting a failure 
of the LSI itself, and satisfies the fail safe control for con- 
trolling on the safety side when an error occurs. 
[0015] Preferably, therefore, an object of the present 
invention is to provide a control circuit which improves 
the self check function for detecting a failure of a con- 
troller and has the fail safe function for controlling onlhe 
safety side when an error occurs and a controller and a 
system using it. 

[0016] Aspects of the present invention are set out in 
the appended claims. 

[0017] Preferably, the present invention comprises a 
command speed frequency conversion means for con- 
verting an ATP command speed signal to a frequency, 

a first data conversion means for converting an out- 
put signal of the command speed frequency con- 
version means to digital data, 
a speed frequency conversion means for convert- 
ing an actual speed of an electric motor vehicle to 
a frequency, 

a second data conversion means for converting an 
output signal of the speed frequency conversion 
means to digital data, 

a brake command output means for outputting a 
brake command signal according to the deviation 
between the output data of the first data conversion 
means and the output data of the second data con- 
version means, 

a means for duplicating the brake command output 
means to a system A and a system B inside an LSI, 
a means for inputting the first data corresponding 
to an ATC command speed signal and the second 
data corresponding to an actual speed of an electric 
motor vehicle to the circuits of the system A and the 
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. system B of the duplicated LSI at the same time; 
a means for generating first control data in which 
CRC data when a generation polynomial expres- 
sion is assumed as GO (X) is added on the basis of 
the first data and second control data in which CRC 
data when a generation polynomial expression is 
assumed as G1 (X) is added, a switching means for 
selecting one of the first control data and the second 
control data, 

a means for checking an error of an output signal 
of the switching means by using the first failure de- 
tector corresponding to the generation polynomial 
expression GO (X) which is connected in parallel 
and the second failure detector corresponding to 
the generation polynomial expression G1 (X); 
a comparison means for comparing an output of the 
first failure detector of the system A and an output 
of the second failure detector, a comparison means 
for comparing an output of the first failure detector 
of the system B and an output of the second failure 
detector, 

a means for controlling the switching means of the 
system B by an output signal of the comparison 
means of the system A and selecting the first control 
data or the second control data; 
a sign inversion means for inverting the sign of an 
output signal of the comparison means of the sys- 
tem B, and; 

a means for controlling the switching means of the 
system A by an output signal of the sign inversion 
means of the system B and selecting the first control 
data or the second control data. 

[0018] Preferably, furthermore : the present invention 
comprises a means for arranging and wiring the system 
A and the system B of the duplicated circuit away from 
each other and a means for widening the arrangement 
inlerval of an output signal of the comparison means of 
the system A and an output signal of the comparison 
means of the system B and the conductor interval. 
[0019] The first control data of the system A and the 
system B are decided as normal by the first failure de- 
tector and output signals thereof are L, whereas they 
are decided as abnormal by the second failure detector 
and output signals thereof are H. The second control 
data are decided as abnormal by the first failure detector 
and output signals thereof are H, whereas they are de- 
cided as normal by the second failure detector and out- 
put signals thereof are L. 

[0020] At the start time of operation, the first control 
data is selected in the system A and the second control 
data is selected in the system B. 

[0021] Therefore, the first control data of the system 
A is checked by the first failure detector and the second 
failure detector, and the output signal L of the first failure 
detector and the output signal H of the second failure 
detector are compared by the comparison means of the 
system A, and; 



the switching means of th£ system B is controlled, 
by a comparison output signal H obtained under this 
condition, and the second control data is switched to the 
first control data. 

5 [0022] When the second control data is switched to 
the first control data ; the output signal L of the first failure 
detector and the output signal H of the second failure 
detector are compared by the comparison means of the 
system B, and a comparison output signal H obtained 

10 under this condition is inverted in sign by the sign inver- 
sion means and goes L, and; 

the switching means of the system A is controlled, 
and the first control data is switched to the second con- 
trol data. 

15 [0023] When the first control data is switched to the 
second control data, the output signal H of the first fail- 
ure detector and the output signal L of the second failure 
detector are compared by the comparison means of the 
system A, and; 

20 the switching means of the system B is controlled 

by a comparison output signal L obtained under this con- 
dition , and the first control data is switched to the second 
control data. 

[0024] When the first control data is switched to the 
25 second control data, the output signal H of the first fail- 
ure detector and the output signal L of the second failure 
detector are compared by the comparison means of the 
system B, and a comparison output signal L obtained 
under this condition is inverted in sign by the sign inver- 
30 sion means and goes H, and; 

the switching means of the system A is controlled, 
and the second control data is switched to the first con- 
trol data. 

When the second control data is switched to the 

35 first control data, the output signal L of the first failure 
detector and the output signal H of the second failure 
detector are compared by the comparison means of the 
system A, and; 

the switching means of the system B is controlled 

40 by a comparison output signal H obtained under this 
condition, and the second control data is switched to the 
first control data. 

When the second control data is switched to the 
first control data, the output signal L of the first failure 

45 detector and the output signal H of the second failure 
detector are compared by the comparison means of the 
system B, and a comparison output signal H obtained 
under this condition is inverted in sign by the sign inver- 
sion means and goes L, and; 

50 the switching means of the system A is controlled, 

and the second control data is switched to the first con- 
trol data. 

[0025] As mentioned above, by a signal obtained by 
an operation of the own system, the switching means of 
55 the opposite system is controlled. Therefore, when the 
control data, the failure detector, the comparison 
means, and the switching means are normal, output sig- 
nals of the switching means of the system A and the 



system B are alternated in a fixed period. However- v&^ii 
when one of them breaks down, alternating signals of 
the switching means of the system A and the system B r 
are stopped. : H-' : - 
[0026] The alternation of alternating signals of the 5 
switching means is monitored. 

[0027] When the system A and the system B of the 
duplicated circuit are arranged and wired away from 
each other and the arrangement interval of another 
comparison means for comparing an output signal of the 10 
comparison means of the system A and an output signal 
of the comparison means of the system B and the con- 
ductor interval are widened, it can be prevented that for 
example, a failure of the system A affects the system B, 
and they operate as if they are normal, and a brake com- *5 
mand signal to be outputted is not outputted, and a 
brake command signal which is not required to be out- 
putted is outputted. 

[0028] Other objects and aspects of the invention will 
become apparent from the following description of em- 20 
bodiments with reference to the accompanying draw- 
ings in which: 



of the present invention;. 
Fig. 21 is a drawing showing another embodiment 
of the present invention; - .;" ■- '}/.->/ :•?*> -^V 
Fig. 22 is a drawing showing another embodiment 
of the present invention; 

Fig. 23 is a drawing showing another embodiment 
of the present invention; • • • 
Fig. 24 is a drawing showing another embodiment 
of the present invention; and 
Fig. 25 is a drawing showing an example of pro- 
gramming in the present invention; 

[0029] A case that the present invention is applied to 
an automatic train controller ATP will be explained here- 
under. 

[0030] The ATP gives braking force to a train accord- 
ing to the deviation between an ATP command speed 
signal sent from the ground and the running speed of 
the train (hereinafter referred to as an electric motor ve- 
hicle) at that time and controls the running speed of the 
electric motor vehicle to less than the command speed. 
[0031 ] Fig. 1 is a block diagram of an ATP system us- 
ing the present invention. 

[0032] In Fig: 1, numeral 1 indicates a rail on which 
an electric motor vehicle runs, 23 a body of the electric 
motor vehicle, 2 a wheel of the electric motor vehicle, 3 
a speed generator attached to the shaft of the wheel 2 
for detecting the speed of the speed generator, 4 a 
waveform shaper (or a signal converter) for shaping the 
waveform of an output voltage from the speed generator 
3 and outputting a speed frequency signal 5 in propor- 
tion to the speed of the electric motor vehicle, 6 an an- 
tenna for receiving a frequency-modulated ATP com- 
mand speed signal from the ground, 7 a car receiver for 
demodulating the frequency-modulated ATP command 
speed signal received by the antenna 6 and then shap- 
ing and amplifying the waveform, 8 an ATP command 
speed signal which is an output signal of the car receiver 
7, 9 an ATP device for controlling the speed of the elec- 
tric motor vehicle from the ATP command speed signal 
and an actual speed of the electric motor vehicle, and 
22 a braking device for receiving a brake command sig- 
nal 21 from the ATP device and giving actual braking 
force to the electric motor vehicle. 
[0033] By using this constitution, the speed of the 
electric motor vehicle is controlled so as to eliminate the 
deviation between the ATP command speed and the ac- 
tual speed of the electric motor vehicle orto prevent the 
actual speed of the electric motor vehicle from exceed- 
ing the ATP command speed. 

[0034] The fail safe technology of the controller of the 
aforementioned ATP device will be explained hereunder 
by referring to Fig. 2. 

[0035] Numeral 1800 indicates a controller, 1810 a 
first processor for inputting and processing first input da- 
ta and outputting first output data 1 860 and a first de- 
tection signal 1 880, 1 820 a second processor for input- 
ting and processing second input data and outputting 



Fig. 1 is a drawing showing an embodiment of the 
present invention; 25 
Fig. 2 is a drawing showing an embodiment of the 
controller of the present invention; 
Fig 3 is a data configuration diagram; 
Fig. 4 is a conceptual diagram of a frequency com- 
parison operation; 30 
Fig. 5 shows the number of operations and failure 
signal waveforms; 

Fig. 6 is a drawing showing a frequency matcher; 
Fig. 7 is a timing chart of the frequency matcher; 
Fig. 8 is a drawing showing another embodiment of 35 
the present invention; 

Fig. 9 is a data configuration diagram of each mem- 
ory; 

Fig. 10 is an illustration for failure detection signals 
and a memory switching operation; 40 
Fig. 11 is a drawing showing a frequency converter; 
Fig. 12 is an illustration for a frequency conversion 
operation; 

Fig. 1 3 is a drawing showing a frequency compara- 
tor; 45 
Fig. 1 4 is a timing chart of a frequency comparison 
operation; 

Fig. 15 is an illustration for a multi-frequency com- 
parison operation; 

Fig. 16 is a drawing showing another embodiment so 
of the present invention; 

Fig. 17 is a drawing showing another embodiment 
of the present invention; 

Fig. 18 is a drawing showing another embodiment 
of the present invention; 55 
Fig. 19 is an illustration for the LSI layout of the 
present invention; 

Fig. 20 is a drawing showing another embodiment 
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^^^£^^;;secbnd output data.;! 870 : 'arid a second detection signal }f$/C 
^irirK 1 890 which is inverted in sign, 1 830 a signal inverter for .:,*;"; 
'."v-- inverting the detection signal processed by the second 
... ■ ■-. processor; ,1900 a first transmitter for transmitting the / . 
first detection signal 1 880 outputted from the first proc- : 5 
essor 1 81 0 to the second processor 1 820, and 1 91 0 a 
second transmitter for transmitting the second detection 
signal 1 890 outputted from the second processor via the 
signal inverter 1830 to the first processor 1 81 0. 
[0036] '. : The first input data and the second input data 
are data which are generated and given by a microcom- 
puter or read from a memory. . 

[0037] As to the first input data, there are cases that 
it has data for processing first output data and check 
data for checking the above data and that it has no check 
data, and check data is generated by processing of the 
first processor, and a first detection signal is generated. 
[0038] As to the second input data, there are cases 
that the content of the data is the same as that of the 
first input data and that the content is different from that 
of the first input data. 

[0039] As to the second input data, there are cases 
that it has check data in the same way as with the afore- 
mentioned first input data and that it has no check data. 
When the second input data has no check data, there 
are cases that check data is generated by the second 
processor in the same way as with the aforementioned 
first input data and that no check data is generated even 
by the second processor. 

[0040] Furthermore, in this embodiment, the first input 
data and the second input data are independent of each 
other. However, one input data can be easily inputted to 
two processors. 

[0041 ] The first processor and the second processor 
process the first or second input data which is sequen- 
tially inputted by a serial processing type ring processor 
or fetch both data in a microcomputer in parallel and per- 
form parallel processing. 

[0042] The first and second detection signals indicate 
whether the first processor and the second processor 
operate normally or abnormally. When alternating sig- 
nals in the predetermined period are outputted, the de- 
tection signals indicate that the processors operate nor- 
mally. 

[0043] These detection signals can be used also as a 
detection signal for indicating whether the check results 
of the contents of input data are correct or wrong. 
[0044] Another device is controlled by the first output 
data and the second output data. . 
[0045] Before outputting to another device, by an out- 
put portion for detecting a match in the first output data 
and the second output data or outputting final output da- 
ta using the first or second detection signal, another de- 
vice to be controlled is controlled. 

[0046] The processing of the controller having the 
aforementioned constitution is as follows: 
[0047] The first example of the processing is a case 
of outputting the first detection signal first and generat- 
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^ing alternating signals by repeating inversion of this sig-HJ 
nal > - .- - - ' ■• ? ./-.v 

[0048] The first input data is inputted and processed 
by the first processor and the first output data and the 
first detection signal are outputted. The first detection 
signal is inputted to the second processor and proc- 
essed together with the second input data and the sec- 
ond output data and the second detection signal are 
generated and outputted. 

[0049] The second detection signal is inverted in sign 
by the signal inverter and inputted to the first processor. 
When the first detection signal processed by the first 
processor is a high (hereinafter referred to as H) level 
signal, the second detection signal processed by the 
: second processor also becomes an H-level signal and 
when the first detection signal of the first processor is a 
low (hereinafter referred to as L) level signal, the second 
detection signal processed by the second processor al- 
so becomes an L level signal. 

[0050] The second detection signal of H level is invert- 
ed in sign by the signal inverter and the detection signal 
of L level is inputted to the first processor. 
[0051 ] Therefore, when the first detection signal proc- 
essed by the first processor is an L-level signal, the L- 
level signal is inputted to the second processor and the 
detection signal of the second processor becomes an 
L-level signal. However, since the signal is inverted in 
sign by the signal inverter, the second detection signal 
of H level is inputted to the first processor and when the 
first processor and the second processor operate nor- 
mally, the first and second detection signals become sig- 
nals alternating to the H, L, H, — levels. 
[0052] The aforementioned processing of the detec- 
tion signal in the first or second processor is output of a 
signal having the same level as the inputted level. 
Namely, when the first detection signal of H or L level is 
outputted from the first processor first, the first and sec- 
ond detection signals become alternating signals there- 
after as long as the first and second processors operate 
normally. 

[0053] The second example of the processing is a 
case of implementing logic between the first detection 
signal outputted from the first processor and the check 
data of the second input data (or the check data gener- 
ated from the second input data) and outputting a de- 
tection signal from the second processor. 
[0054] By doing this, the present invention not only 
detects whether the first or second processor operates 
normally or abnormally but also can check whether the 
first or second input data is normal or abnormal. 
[0055] Namely, when the first detection signal does 
not match the check data of the second input data, a 
signal of a different level from that of the first detection 
signal is outputted from the second processor as a de- 
tection signal. By doing this, the second detection signal 
via the signal inverter becomes a signal of the same lev- 
el as that of the first detection signal, so that no alter- 
nating signal is outputted. 
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[0056] : The same may be said with the second detec- ; 
tion signal of the first processor and the check data of 
the first input data. In the case of this processing, a con- 
stitution having a logic unit for implementing logic in the 
processor is used. 

[0057] Next, the constitution of the ATP device 9 
shown in Fig. 1 which has the aforementioned charac- 
teristics of the controller in the automatic train control 
system will be explained. 

[0058] The ATP device 9 comprises a first microcom- 
puter 1 0 for converting the ATP command speed signal 
8 to control data 12 of the first microcomputer, a second 
microcomputer 11 for converting the ATP command 
speed signal 8 to control data 13 of the second micro- 
computer by performing the same process as that for 
the first microcomputer, a logic circuit 15 of the system 
A for implementing logic between the control data 12 of 
the first microcomputer 1 0 and a speed frequency signal 
5 and outputting an A system logic output signal 17, a 
logic circuit 16 of the system B for implementing logic 
between the control data 13 of the second microcom- 
puter 11 and the speed frequency signal 5 and output- 
ting a B system logic output signal 18, and a controller 

1 4 having a duplicated logic constitution of a logic circuit 

1 5 of the system A and a logic circuit 1 6 of the system B. 
[0059] The logic circuit 1 5 of the system A comprises 
a frequency converter 1 50 for converting the control da- 
ta 1 2 of the first microcomputer to an ATP command 
speed frequency (signal) 151, a second transmitter for 
transmitting an ATP command speed frequency signal 
2150 to a third processor 2030, a third transmitter 2200 
for transmitting a third detection signal 2160 to a fourth 
processor 2040, and a fourth transmitter 221 0 for trans- 
mitting a fourth detection signal 21 70 outputted from the 
fourth processor 2040 via a sign inverter 2050 to a first 
processor 2010. 

[0060] First input data 2060, second input data 2070, 
third input data 2080, and fourth input data 2090 are da- 
ta which are generated and given by the microcomputer 
or read from the memory. 

[0061] As to the first input data 2060, there are cases 
that it has data for processing first output data 2100 and 
check data for checking the above data and that it has 
no check data, and check data is generated by process- 
ing of the first processor 201 0, and a first detection sig- 
nal 2140 is generated. 

[0062] Also as to the second input data 2070, there 
are cases that it has data for processing second output 
data 2110 and check data for checking the above data 
and that it has no check data, and check data is gener- so 
ated by processing of the second processor 2020, and 
the second detection signal 2150 is generated. 
[0063] Also as to the third input data 2080, there are 
cases that it has data for processing third output data 
2120 and check data for checking the above data and 55 
that it has no check data, and check data is generated 
by processing of the third processor 2030, and the third 
detection signal 2160 is generated. 



[0064] Also as to the fourth Input data 2090, there are 
cases that it has data for processing fourth output data 
2130 and check data for checking the above data and; 
that it has no check data; and check data is generated 
by processing of the fourth processor 2040, and the" 
fourth detection signal 2170 is generated. 
[0065] The first processor 201 0 processes the first in- 
put data 2060 which is sequentially inputted by a dedi- 
cated serial processing type ring processor or fetches; 
the data in the microcomputer in parallel and performs 
parallel processing. 

[0066] The second processor 2020 also processes 
the second input data 2070 which is sequentially input- 
ted by a dedicated serial processing type ring processor 
or fetches the data in the microcomputer in parallel and 
performs parallel processing; 

[0067] The third processor 2030 also processes the 
third input data 2080 which is sequentially inputted by a 
dedicated serial processing type ring processor or fetch- 
es the data in the microcomputer in parallel and per- 
forms parallel processing. 

[0068] The fourth processor 2040 also processes the 
fourth input data 2090 which is sequentially inputted by 
a dedicated serial processing type ring processor or 
fetches the data in the microcomputer in parallel and 
performs parallel processing. 

[0069] The first detection signal 2140 indicates 
whether the first processor 201 0 operates normally or 
abnormally, and the second detection signal 2150 indi- 
cates whether the second processor 2020 operates nor- 
mally or abnormally, and the third detection signal 21 60 
indicates whether the third processor 2030 operates 
normally or abnormally, and the fourth detection signal 
21 70 indicates whether the fourth processor 2040 oper- 
ates normally or abnormally, and they are alternating 
signals which alternate in the predetermined period re- 
spectively. 

[0070] These detection signals can be used also as a 
signal for indicating whether the check results of the 
contents of input data are correct or wrong. 
[0071] Namely, the first processor 2010 outputs the 
processing result for checking the content of the input 
data 2060 as the detection signal 21 40, and the second 
processor 2020 outputs the processing result for check- 
ing the content of the input data 2070 as the detection 
signal 2150, and the third processor 2030 outputs the 
processing result for checking the content of the input 
data 2080 as the detection signal 2160, and the fourth 
processor 2040 outputs the processing result for check- 
ing the content of the input data 2090 as the detection 
signal 2170. 

[0072] The output data 2100 of the first processor 
2010, the output data 2110 of the second processor 
2020, the output data 21 20 of the third processor 2030, 
and the output data 2130 of the fourth processor 2040 
are outputted to another device so as to control it. 
[0073] Before outputting to another device, by an out- 
put portion, for example, for detecting a match in the first 
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output data 2120, and the fourth output data 2130; 
tecting a match in the first output data 21 00 and the sec- v.- 
,ond output data 21 1 0, detecting a match in the third out--, l- 
put data 2120 arid the fourth output data 2130, or fur-;l 
thermore outputting final output data using the first de- : 
tection signal 2140, the second detection signal 2150, 
the third detection signal 21 60, and the fourth detection 
signal 21 70, another device to be controlled is control- 
led. \\ ' • 

[0074] The processing of a controller 2000 having the 
aforementioned constitution is as follows: 
[0075] The first input data 2060 is inputted to the first 
processor 2010, and the second input data 2070 is in- 
putted to the second processor 2020, and the third input 
data 2080 is inputted to the third processor 2030, and 
the fourth input data 2090 is inputted to the fourth proc- . 
essor 2040, and operations are executed respectively. 
[0076] The first output data 2100 and the first detec- 
tion signal 2140 are outputted from the first processor 20 
2010. 

[0077] The first detection signal 2140 is inputted to the 
second processor 2020 and processed together with the 
second input data 2070 and the second output data 
2110 and the second detection signal 2150 are gener- 25 
ated, and the second detection signal 2150 is inputted 
to the third processor 2030 and processed together with 
the third input data 2080 and the third output data 2120 
and the third detection signal 21 60 are generated, and 
the third detection signal 2160 is inputted to the fourth 50 
processor 2040 and processed together with the fourth 
input data 2090 and the fourth output data 21 30 and the 
fourth detection signal 2170 are generated, and the 
fourth detection signal 2170 is inverted in sign by the 
sign inverter 2050 and inputted to the first processor 35 
2010. 

[0078] When the first detection signal 2140 of by the 
first processor 201 0 is an H-level signal, the second de- 
tection signal 2150 of the second processor 2020 also 
becomes an H-fevel signal and when the first detection *o 
signal 2140 is a L level signal, the second detection sig~- 
nal 2150 of the second processor 2020 also becomes 
ah L level signal. 

[0079] The outputs of the detection signals of all the 
processors are assumed as L level first. Therefore, the 45 
sign inversion signal 221 0 of the fourth detection signal 
2140 of the fourth processor 2040 becomes an H-level 
signal and is inputted to the first processor 201 0. 
[0080] As a result, when processed by the first proc- 
essor 2010, the output level of the first detection so 
signa!2140 becomes H, and when processed by the 
second processor 2020 next, the output level of the sec- 
ond detection signal 2150 becomes H, and when proc- 
essed by the third processor 2030 next, the output level 
of the third detection signal 21 60 becomes H, and when 55 
processed by the fourth processor 2040 finally, the out- 
put level of the fourth detection signal 21 70 becomes H. 
[0081] Since the sign of the output of the fourth de- 



the output level of the sigh: inversion ' signal 221 0: is^ 
changed from H to L f-; f * * ' 

[0082] Therefore, the output level of trie first detection;^ 
signal 2140 of the first processor 201 0 is changed from r 4 
H to L, and the output level of the second detection sig- 
nal 21 50 of the second processor 2020 is changed from >. 
H to L, and the output level of the third detection; signal 
21 60 of the third processor 2030 is changed from hi to ; 
Lnext, and the output level of the fourth detection signal - 
21 70 of the fourth processor 2040 is changed from H to 
L finally. .-. . • " 
[0083] Since the sign of the output of the fourth de-\; 
tection signal 21 70 is inverted by the sign inverter 2050, 
the output level of the sign inversion signah 2210 is 
changed from H to L and returned to the initial state. : 
[0084] Since the detection signals are connected in a 
loop from the first processor to the fourth processor as 
mentioned above, the first input data to the fourth input 
data and the first processor to the fourth processor are 
all normal. When they operate correctly, the first detec- 
tion signal 2140 to the fourth detection signal 21 70 be- 
come alternating signals which alternate in a fixed peri- 
od and when one of the processors breaks down and 
the corresponding detection signal is fixed to H or L, the 
alternation of the detection signals constituting the loop : 
is stopped. 

[0085] Therefore, it is desirable to monitor a failure de- 
tection signal of the loop and take an emergency action 
at the time of alternation stop. If all the failure detection 
signals are monitored, a broken-down processor can be 
known and the failure can be analyzed more briefly. 
[0086] In Fig. 20, an embodiment having four proces- 
sors is explained. However, even if processors in an op- 
tional number are provided, it is desirable to connect a 
failure detection signal in the same way and there are 
no restrictions on the number of processors. 
[0087] Fig. 21 is a drawing showing another embodi-. 
ment of the present invention. Fig. 21 is a drawing of an 
embodiment in which the processors are shared, and 
the input portions comprise a time division operation 
type parallel-serial converter, and the output portions 
comprise a time division operation type serial-parallel 
converter. 

[0088] A controller 3000 comprises a first control cir- 
cuit 3010 including a time division operation type paral- 
lel-serial converter 3020, a first processor 3030, and a 
time division operation type serial-parallel converter 
3040 and a second control circuit 3200 including a time 
division operation type parallel-serial converter 321 0, a. 
second processor 3220, and a time division operation 
type serial-parallel converter 3230. A failure detection 
signal 3130 of the first control circuit 301 0 is inputted to 
the parallel-serial converter 3210 of the second control 
unit 3200, and a failure detection signal 3320 of the sec- 
ond control circuit 3200 is inverted in sign by a sign in- : 
verter 3330, and a sign inversion signal 3340 is inputted 
to the parallel-serial converter 3020 of the first control 
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Unit 3010. '- ~« *. * - ' 

[0089] First input data 3050, second input data 3060, 
and third input data 3070 are inputted to the parallel- 
serial converter 3020 of the first control circuit 301 0 arid 
fourth input data 3240, fifth input data 3250, and sixth 
input data 3260 are inputted to the parallel-serial con- 
verter 3210 of the second control circuit 3200. 
[0090] It is assumed that the output levels of the fail- 
ure detection signal 3130 of the first control circuit 301 0 
and the failure detection signal 3320 of the second con- 
trol circuit 31 30 are L first. 

[0091] The first input data 3050 is converted to a serial 
signal 3080 by the^parallel-serial converter 3020 of the 
first control circuit 301 0, processed by the first processor 
3030, outputted as a serial output signal 3090, convert- 
ed to a parallel signal by the serial-parallel converter 
3040, and then outputted as an output signal 3100. 
[0092] On the other hand, the fourth Input data 3240 
is converted to a serial signal 3270 by the parallel-serial 
converter 321 0 of the second control circuit 3200, proc- 
essed by the second processor 3220, outputted as a se- 
rial output signal 3280, converted to a parallel signal by 
the serial-parallel converter 3230, and then outputted as 
an output signal 3290. 

[0093] In the same way, the second input data 3060 
inputted to the first control circuit 3010 is processed by 
the first processor 3030 and outputted as an output sig- 
nal 3110, and the fifth input data 3250 inputted to the 
second control circuit 3200 is processed by the second 
processor 3220 and outputted as an output signal 3300, 
and the third input data 3070 inputted to the first control 
circuit 301 0 is processed by the first processor 3030 and 
outputted as an output signal 3120, and the sixth input 
data 3260 inputted to the second control circuit 3200 is 
processed by the second processor 3220 and outputted 
as an output signal 3310. 

[0094] Next, when the failure detection signal 3320 of 
the second control circuit 3200 is inverted in sign by the 
sign inverter 3330 and the sign inversion signal 3340 of 
H level is inputted to the parallel-serial converter 3020 
of the first control circuit 301 0, the failure detection sig- 
nal 3130 of H level is outputted by the same operation 
as that mentioned above. 

[0095] Since the failure detection signal 31 30 of H lev- 
el of the first control circuit 3010 is inputted to the par- 
allel-serial converter 321 0 of the second control circuit 
3200, the failure detection signal 3320 of H level is out- 
putted by the same operation as that mentioned above. 
[0096] Since this failure detection signal 3320 of H 
level is inverted in sign by the sign inverter 3330 and the 
failure detection signal of L level is inputted to the par- 
allel-serial converter 3020 of the first control circuit 
301 0, the failure detection signal 3130 of H level is out- 
putted by the same operation as that mentioned above. 
[0097] Therefore, when the first control circuit 3010 
and input data and the second control circuit 3200 and 
input data are normal, the failure detection signal 3130 
of the first control circuit 3010 and the failure detection 
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signal 3320 of the second control circuit 3200 become^ 
alternating signals which alternate in a fixed period;: 
[0098] In Fig. 21, the first processor 3020 and the sec- 
ond processor 3210 may use a microcomputer In this 
case, various ways can be selected by a program. For 
example, by a method for executing the failure detection 
process after the input data process or executing the 
input data process and the failure detection process in 
parallel, the same operation as that mentioned above 
can be realized. 

[0099] Needless to say, by replacing the parallel-se- 
rial converter with a multiplexer and the serial-parallel 
converter with a demultiplexer, the same operation can 
be realized. 

[0100] Fig. 22 is a drawing showing another embodi- 
ment of the present invention. It is a difference that in 
the embodiment shown in Fig. 22, the sign inverter 2050 
in the embodiment shown in Fig, 20 is a 1 -bit adder 
2220. The others are all the same, so that the explana- 
tion of the operations thereof is omitted and the opera- 
tion of the adder 2220 shown in Fig . 22 will be explained 
hereunder. 

[0101] It is assumed that the first processor 2010, the 
second processor 2020, the third processor 2030, and 
the fourth processor 2040 constituting the controller 
2000 are normal and the output levels of the first detec- 
tion signal 2140, the second detection signal 2150, the 
third detection signal 21 60, and the fourth detection sig- 
nal 2170 are L. 

[0102] The first input data 2060 is inputted and proc- 
essed by the first processor 2010 and outputted as the 
first detection signal 2140 of L level. This first detection 
signal 2140 is inputted to the second processor 2020, 
processed together with the second input data 2070, 
and outputted as the second detection signal 2150 of L 
level. This second detection signal 2150 is inputted to 
the third processor 2030, processed together with the 
third input data 2080, and outputted as the third detec- 
tion signal 2160 of L level. This third detection signal 
21 60 is inputted to the fourth processor2040, processed 
together with the fourth input data 2090, and outputted 
as the fourth detection signal 21 70 of L level. 
[01 03] This fourth detection signal 21 70 is inputted to 
the adder 2220 and added to H-level data, so that the 
output level of an output signal 2210 thereof becomes 
H and the signal is inputted to the first processor 201 0. 
[0104] Since this H-level output signal 2210 is proc- 
essed together with the first input data 2060, the first 
detection signal 2140 becomes an H-level signal and 
hereafter by the same operation, the second detection 
signal 2150 of the second processor 2020 becomes an 
H-level signal, and the third detection signal 21 60 of the 
third processor 2030 becomes an H-level signal, and the 
fourth detection signal 2170 of the fourth processor 
2040 becomes an H-level signal. 

[01 05] When this fourth detection signal 21 70 is input- 
ted to the adder 2220 and added to H-level data, the 
output level of the output signal 2210 thereof becomes 
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v T . L. This output signal 221 0 is inputted to the first proees- 
;.>'; } sor 20 1 0 and processed togeth er with th e f i rst i nput da- / 
ta. Namely, it is returned to the initial state. 
. [0106] Therefore, when each unit of the controller 
2000 is normal, the first detection signal 21 40, the sec- 5 
ond detection signal 2150, the third detection signal 
.2160, and the fourth detection signal 21 70 constituting 
a loop become alternating signals which alternate to the 
H or L level in a fixed period, so that it is desirable to 
present a constitution that one of the signals is moni- : 10 
tored and when the alternation is stopped, emergency 
control is executed. 

[01071 ,n F '9- 22. an example of four processors is ex- 
plained as in Fig. 20. However, even if processors in an 
optional number are provided, it is desirable to connect '5 
them in the same way and there are no restrictions on 
the number of processors. 

[0108] Fig. 23 is a drawing showing another embodi- 
ment of the present invention. It is a difference from Fig. 
20 that in the embodiment shown in Fig. 23, 2-bit data 20 
of "0" "1" (indicating 1 in decimal) is added to a 2-bit 
detection signal of a processor and the addition output 
signal is inputted to the next processor and processed 
together with a signal inputted to the processor. 
[0109] In Fig. 23, the first processor 201 0, the second 25 
processor 2020, the third processor 2030, and the fourth 
processor 2040 and the first adder 2220, the second 
adder 2230, the third adder 2240, and the first subtracter 
2250 are normal respectively, and the output of the first 
detection signal 2140 indicating a status 2 bits long is 30 
"0" u 0° (indicating 0 in decimal), and the output of the 
second detection signal 21 50 is also M 0 H "0", and the out- 
put of the third detection signal 21 60 is also "0" "0\ and 
the output of the fourth detection signal 21 70 is also "0" 




"0". 



35 



[01 10] Since the first input data 2060 is inputted and 
processed by the first processor, the first output data 
2100 and "0" B 0 tt of the first detection signal 2140 are 
outputted. 

[0111] Since the output "0" "0" of the first detection 40 
signal 2140 is added to 2-bit data of "0" "1" (indicating 
1 in decimal) by the first adder 2220, the addition output 
2260 becomes U 0 M "1". : . 

[0112] Since M 0 M "1" of the addition output 2260 is in- 
putted to the second processor 2020 and processed to- 45 
gether with the second input data 2070, the second out- 
put data 21 10 and "0" "1 M of the second detection signal 
2150 are outputted; 

[01 1 3] Since the output M 0 M "1 " of the second detection 
signal 2150 is added to data of M 0 M w 1 u by the second 50 
adder 2230, the addition output 2270 becomes "1" "0" 
(indicating 2 in decimal). 

[01 1 4] Since "1 " "0" of the addition output 2270 is in- 
putted to the third processor 2030 and processed to- 
gether with the third input data 2080, the third output 55 
data 2120 and "1' "0" of the third detection signal 2160 
are outputted. 

[0115] Since the output "1° "0" of the third detection 



signal 21 60 is added to data of, n 0" "i " by the third ^dclerrW 
2240, the addition output 2280 becomes "1 " "1 (indicat- 
ing 3 in decimal). ' " 
[0116] Since M 1 U "1" of the addition butput 2280 is in- : V 
: putted to the fourth processor 2040 and processed to- 
gether with the fourth input data 2090, the fourth output 
data 21 30 and "1 M M 1 " of the fourth detection signal 21 70 
are outputted. 

[01 17] Since "1 ? *r of the fourth detection r signal 21 70 
is inputterito thefirst subtracter 2250 and data of "t"-"0" V 
(indicating 2 in decimal) is subtracted from data of "1" 
"1", the subtraction output 2290 becomes "0" "1".. 
[01 18] Since "0" n 1 " of the subtraction output 2290 is 
inputted to the first processor 2010 and processed to- 
gether with the first input data 2090, the first output data 
2100 and M 0" w 1" of the first detection signal 2140 are 
outputted. 

[0119] Since m 0" B r of the first detection signal 2140 
is added to data of "0" "1° by the first adder 2220, the 
addition output 2260 becomes M 1 M "0" (indicating 2 in 
decimal). 

[0120] Since n 1 M "0° of the addition output 2260 is in- 
putted to the second processor 2020 and processed to- 
gether with the second input data 2070, the second out- 
put data 211 0 and "1 " "O" of the second detection signal 
2150 are outputted. 

[0121] Since M 1 M "0" of the second detection signal 
2150 is added to data of "0" M 1 M by the second adder 
2230, the addition output 2270 becomes "1 " "1 " (indicat- 
ing 3 in decimal). 

[0122] Since M 1 n "1" of the addition output 2270 is in- 
putted to the third proce sor 2030 and processed togeth- 
er with the third input data 2080, the third output data 
2120 and "1" "1 M of the third detection signal 2160 are 
outputted. 

[0123] Since "1" "1" of the third detection signal 2160 
is added to data of "0" "1 " by the third adder 2240, the 
addition output 2280 becomes "0" "0" (indicating 0 in 
decimal). 

[01 24] Since n 0" "0" of the addition output 2280 is in- 
putted to the fourth processor 2040 and processed to- 
gether with the fourth input data 2090, the fourth output 
data 2 130 and "0" M 0" of the fourth detection signal 21 70 
are outputted. 

[0125] Since "0 U "0" of the fourth detection signal 21 70 
is inputted to the first subtracter 2250 and data of "1 " M 0" 
is subtracted, the subtraction output 2290 becomes "1" 
"0 M (indicating 2 in decimal). 

[0126] Since 'T "0" of the subtraction output 2290 is 
inputted to the first processor 201 0 and processed to- 
gether with the first input data 2090, the first output data 
2100 and B 1 w M 0" of the first detection signal 2140 are 
outputted. 

[0127] Since "1" "0" of the first detection signal 2140 
is added to data of M 0 H "1" by the first adder 2220, the 
addition output 2260 becomes "1" M 1" (indicating 3 in 
decimal). 

[0128] Since H 1 " "1 " of the addition output 2260 is in- 
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putted to the second processor 2020 and processed to- ; 
gether with the second input data 2070, the second out- 
put data 21 10 and "1" "1 M of the second detection signal 
2150 are outputted. 

[0129] Since "1 M "1" of the second detection signal 
2150 is added to data of "0" "1" by the second adder 
2230, the addition output 2270 becomes H 0" M 0" (indicat- 
ing 3 in decimal). 

[0130] Since M 0" "0" of the addition output 2270 is in-, 
putted to the third processor 2030 and processed to- 
gether with the third input data 2080, the third output 
data 21 20 and M 0" "0" of the third detection signal 21 60 
are outputted. 

[0131] Since "0" "0 M of the third detection signal 21 60 
is added to data of M 0" "1" by the third adder 2240, the 
addition output 2280 becomes W 0 W w 1" (indicating 1 in 
decimal). 

[0132] Since M 0 M "1" of the addition output 2280 is in- 
putted to the fourth processor 2040 and processed to- 
gether with the fourth input data 2090, the fourth output 
data 21 30 and "O" "1 ■ of the fourth detection signal 21 70 
are outputted. 

[0133] Since "0" "1" of the fourth detection signal 21 70 
is inputted to the first subtracter 2250 and data of "1 " "0" 
is subtracted, the subtraction output 2290 becomes "0" 
"0" (indicating 0 in decimal). 

[0134] Since "0" "0" of the subtraction output 2290 is 
inputted to the first processor 201 0 and processed to- 
gether with the first input data 2090, the first output data 
2100 and "O" "0" of the first detection signal 2140 are 
outputted. 

[0135] When the controller 2000 is structured so that 
"O" "1" (1 in decimal) is added to an output signal of the 
first failure detection signal of the first processor and the 
addition signal is inputted to the second processor, and 
"0" "1 M (1 in decimal) is added to an output signal of the 
second failure detection signal and the addition signal 
is inputted to the third processor, and "0 M "1" (1 in deci- 
mal) is added to an output signal of the third failure de- 
tection signal and the addition signal is inputted to the 
fourth processor, and H 1 M "0" (2 in decimal) is subtracted 
from an output signal of the fourth failure detection sig- 
nal and the subtraction signal is inputted to the first proc- 
essor, the failure detection signals of the processors be- 
come alternating signals which alternate in a fixed peri- 
od when the units of the controller 2000 are normal. 
[0136] In Fig. 23, an example of four processors is ex- 
plained as in Fig. 22. However, even if processors in an 
optional number are provided, it is desirable to connect 
them in the same way and there are no restrictions on 
the number of processors. 

[0137] Fig. 24 shows another embodiment of the 
present invention . Fig. 24 is different from Fig. 21 in the 
processing method for the second detection signal. 
[0138] Namely, when the first input data 3050 is all 
inputted to the first control circuit 301 0 in Fig. 24, the 
second input data 3060 is inputted next, and when the 
second input data 3060 is all inputted, the third input 



?i ;• data 3070 is inputted next, and when the third input data 
3070 is all Inputted, CRC data 3140 for checking daia • 
is inputted next as a failure detection signal 3160 via a 
first adder 31 50; <v/^ rr- -"'-V' 

5 [0139] These data are converted sequentially to a se- 
rial signal 3080 by the parallel - serial converter 3020, 
inputted to the first processor 3030, processed as pre- 
determined, and outputted as a serial signal 3090. This 
serial signal 3090 is converted to and outputted as an 
10 output signal 31 00, an output signal 3110, and an output 
signal 3120 which are parallel with each other by the 
serial - parallel converter 3040, so that another device 
is controlled and furthermore the failure detection signal 
3130 is outputted and inputted to the second adder 
15 3340. 

[0140] When the fourth input data 3240 is all inputted 
to the second control circuit 3200 in the same way, the 
fifth input data 3250 is inputted next, and when the fifth 
input data 3250 is all inputted, the sixth input data 3260 
20 is inputted next, and when the sixth input data 3260 is 
all inputted, CRC data 3330 for checking data is inputted 
next as a failure detection signal 3350 via the second 
adder 3340. 

[0141] These data are converted sequentially to a se- 
25 rial signal 3270 by the parallel - serial converter 3210, 
inputted to the second processor 3220, processed as 
predetermined, and outputted as a serial signal 3280. 
This serial signal 3280 is converted to and outputted as 
an output signal 3290 : an output signal 3300, and an 
30 output signal 3310 which are parallel with each other by 
the serial - parallel converter 3230, so that another de- 
vice is controlled, and furthermore the failure detection 
signal 3320 is outputted and inverted in sign by the sign 
inverter 3350, and a sign inversion failure detection sig- 
35 nal 3360 is inputted to the first adder 3150. 

[0142] In the initial state, it is assumed that the output 
levels of the detection failure signal 31 30 of the first con- 
trol circuit 3010 and the detection failure signal 3320 of 
the second control circuit 3200 are L. 
40 [0143] The L-Jevel detection failure signal 3130 of the 
first control circuit 3010 is inputted to the second adder 
3340 of the second control circuit 3200 but the CRC data 
3330 will not be destroyed. In other words, the normal 
CRC data 3350 is inputted to the second serial - parallel 
45 converter 3210. 

[0144] On the other hand, the output level of a sign 
inversion signal 3370 of the detection failure signal 3320 
of the second control circuit 3200 is H. The H-level sign 
inversion signal 3370 is inputted to the first adder 31 50 
so and destroys the CRC data 3140. 

[0145] This destroyed CRC data 3160 is inputted to 
the first para He! -serial converter 3020, so that it is proc- 
essed by the first processor 3030 and the H-level failure 
detection signal 3 1 30 is outputted via the first serial-par- 
55 allel converter 3040. 

[0146] This H-level failure detection signal 3130 is in- 
putted to the second adder 3340, so that the CRC data 
3330 is destroyed. 
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el failure detection signal 3320 is outputted via the sec-^¥ 



ond serial-parallel converter 3230. : ; : ? K ■ " "->. 
[0148] This H-level failure detection signal 31 30 is in- 
verted in sign by the sign inverter 3360 and an L-level 
signal is inputted to the first adder 3150. 
[0149] Namely, since the CRC data 3140 is not de-, : 
stroyed by the first processor 31 50, the normal CRC da- v.- 10 
ta is inputted to the first parallel-serial converter. Name- 
ly, it is returned to the initial state and controlled. 
[01 50] As mentioned above, when all the units of the 
controller 3000 are normal, the failure detection signal 
31 30 and the failure detection signal 3320 are alternated 15 
in a fixed period. 

[0151] Fig. 25 is an example of a program when the 
first processor and the second processor shown in Figs. 
21 and 24 comprise a microcomputer respectively! The 
data processing is executed after the input process is 20 
executed and the output process is executed according 
to the result. When this process ends, the diagnosis 
process for detecting a failure starts. Namely, the failure 
diagnosis process is executed after the input process 
for detecting a failure is executed and when this process 25' 
ends, the output process is executed. Namely, when it 
is normal, no signal is outputted. However, when it is 
abnormal, a signal is outputted and for example/an 
emergency process is executed. 



[Effects of the Invention] 

[0152] As mentioned above, according to the present 
invention, a normal operation and an abnormal opera- 
tion of a controller comprising a plurality of processors 
or logic units can be detected certainly. 
[0153] The content of input data processed by each 
processor can be checked, so that not only a normal 
operation and an abnormal operation of the hardware 
but also a normal operation and an abnormal operation 
of the software can be detected. 
[0154] When the present invention is applied to an 
ATP device, control data for the two systems are gen- 
erated from an ATP command speed signal, and each 
logic unit in the ATP device is duplicated so as to proc- 
ess each control data, and each system has at least two 
CRC data for checking the control data. By changing the 
opposite CRC data of each logic unit or selecting one of 
the two according to the content of a failure detection 
signal from each duplicated logic unit, checking of the 
control data and checking of the operation of each logic 
circuit can be realized. 

[0155] The ATP device comprises a frequency com- 
parator 1 52 for comparing the ATP command speed fre- 
quency 1 51 and the speed frequency 5 and a failure de- 
tector 153 for checking the content of the control data 
1 2 of the first microcomputer and the status of the logic 
circuit 15 on the basis of a failure detection signal from 



30 



35 



40 



45 



so 



55 



r - a frequency converter 1 60 for converting the control da- 
ta 13 of the second microcomputer to an ATP command 
speed frequency (signal). 161, a frequency comparator 
162 for comparing. the ATP command speed frequency 
151 and the speed frequency 5, and the failure detector . 
153 for checking the content of the control data 13 of 
the second microcomputer and the status of the logic 
circuit 1 6 on the basis of a failure detection signal from 
the system A and outputting a B system failure detection 
signal 164. 

[0157] Numeral 19 indicates a logic circuit for gener- 
ating a sign inversion signal 1 65 for inverting the sign of 
the B system failure detection signal 164 and inputting 
it to the failure detector 1 53 of the system A. For exam- 
ple, it is an inverter circuit. This sign inversion logic cir- 
cuit 1 9 is connected between the output side of the fail- 
ure detector 153 of the system A and the input side of 
the failure detector 163 of the system B. However, the 
sign of the failure detection signal 154 of the system A 
may be inverted. 

[0158] The ATP command speed is a limit speed 
which is preset according to the trajectory condition and 
others and flows through the rail 1 as a frequency-mod- 
ulated signal. 

[0159] This ATP command speed is received by the 
receiving antenna 6 of a running electric motor vehicle 
and demodulated, amplified, and shaped at the same 
time by the car receiver 7, and then detected. 
[0160] The speed frequency 5 in proportion to the 
speed of an electric motor vehicle is detected by shaping 
the output voltage of the speed generator 3 directly con- 
nected to the axle of the electric motor vehicle by the 
waveform shaper 4. 

[0161] The ATP command speed signal 8 of the car 
receiver 7 is inputted to the first microcomputer 1 0 and 
the second microcomputer 11 of the ATP device 9 re- 
spectively and converted to control data or processed. 
[0162] Namely, assuming the data corresponding to 
the ATP command speed signal is one word in length, 
n kinds of ATP command speed signals are converted 
to data of n words. 

[0163] Control data generated by converting or 
processing by the microcomputers 10 and 11 is stored 
in the memory built in the microcomputers 10 and 11 
and outputted as control data 12 and 13 sequentially. 
[0164] The memory retaining the control data 12 and 
1 3 may be the memories built in the microcomputers 1 0 
and 1 1 , or the memories or microcomputers (not shown 
in the drawing) built in the logical circuit 15 and the log- 
ical circuit 16, or a memory installed independently of 
the ATP device. 

[01 65] A memory or different memories may retain the 
control data 12 and 13. 

[0166] Fig. 1 shows an example in which the above 
memory is built in each microcomputer. 
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[0167] : Each of these memories may be a storage de-^:v> ; . 
vice including a cache memory. v^ -, --.: : '; ; '" : V^ : '- ; 'J-; v '.- : 

(1) shown in Fig. 3 is generated by the first micro- : • 
computer 1 0 and shows data D, D to DI^ stored at 5 
the addresses Al 0 to A^^ of the memory. In the 
same way, (2) shown in Fig. 3 is generated by the 
second microcomputer 11 and shows data Dl 0 to 
■ Dl x _ 1 stored at the addresses Al 0 to Al x .i of the 
memory. 

[0168] At the end of the data Dl 0 to Dl x _., of the first 
microcomputer 1 0, CRC data D CRC1 one word in length 
is added for detection of a failure. The low-order bits to 
the high-order bits of the data Dl 0 to Dl x _«, and D CRC1 at 
the addresses Al 0 to At n are outputted serially. The out- 
putted serial data is inputted to the logic circuit 15 of the 
system A as the control data 12 of the first microcom- 
puter. 

[0169] In the same way, at the end of the data Dl 0 to 
D\ x ^ of the second microcomputer 11 , CRC data D CRC2 
one word in length is added for detection of a failure. 
The low-order bits to the high-order bits of the data Dl 0 
to 0\ X _ A and D CRC2 at the addresses Al 0 to Al n are out- 
putted serially. The outputted serial data is inputted to 
the logic circuit 16 of the system B as the control data 
13 of the second microcomputer. 
[0170] In this case, it is desirable that the data Dl 0 to 
D1 X _.| is the same in both the systems A and B and this 
embodiment shows a case that the data Is the same. 
[0171] In the logic circuit 15 of the system A, the con- 
trol data 12 is converted to n kinds of ATP command 
speed frequencies 151 according to the ATP command 
speed signals by the serial operation type frequency 
converter 150 (a ring arithmetic circuit described later) 
and outputted serially. 

[0172] The serially outputted signals are inputted to 
the frequency comparator 152 (described later). 
[0173] In the same way, in the logic circuit 16 of the 
system B, the control data 13 is converted to ri kinds of 
ATP command speed frequencies 161 according to the 
ATP command speed signals by the serial operation 
type frequency converter 1 60 (a ring arithmetic circuit 
described later) and outputted serially. 
[0174] The serially outputted signals are inputted to 
the frequency comparator 1 62 (described later). 
[0175] In this case, D C RC1 of tne system A and Pcrc2 
of the system B have CRC data generated by at least 
two different generation polynomial expressions re- 
spectively, that is : D CRC10 and D CRC11 for the system A 
and D CRC2 o and D CRC21 for the system B. As to these 
CRC data, two CRC data may be generated from one 
CRC data. 

[01 76] These C RC data are not f req uency-converted 
by the frequency converters 150 and 1 60. 
[0177] The speed frequency 5 is inputted to the other 
one of the frequency comparator 152 of the system A 
and compared with the ATP command speed frequency 



151 and the comparison result is outputted serially as 
the output signal 17.* ; Sf; r ' . : > 
[0178] In the same way; the speed frequency 5 is irH 
putted to the other one of the frequency comparator 1 62 
of the system B and compared with the ATP command 
speed frequency 161 and the comparison result is out- 
putted serially as the output signal 18. 
[0179] The matcher 20 compares and collates the 
output signal 1 7 of the logicircuit 1 5 and the output signal 
18 of the logic circuit 16 and outputs a matched signal 
to the braking device 22 as the brake command 21 
[0180] Fig. 4 shows a conceptual diagram of the fre- 
quency comparison operation when an electric motor 
vehicle stops at the predetermined position and the re- 
lation between the ATP command speed frequency, the 
speed frequency of the electric motor vehicle, and the 
brake command will be explained. 
[01 81 ] In Fig. 4, the axis of ordinate indicates the ATP 
command speed frequency f ATP , and the axis of abscis- 
sa indicates the time t, and a symbol f v indicates the 
speed frequency of the electric motor vehicle. 
[01 82] The relation between the ATP command speed 
frequency fATpo ancl tne speed frequency f v of the elec- 
tric motor vehicle at the time t 0 is f A -r P0 > V During the 
period from the time to to tj, neither the running com- 
mand nor the brake command are given to the electric 
motor vehicle and the electric motor vehicle is in the 
state that it starts deceleration by coasting. 
[0183] Assuming that the ATP command speed fre- 
quency f ATP0 is changed to f ATP1 at the time t t in this 
state, f ATP1 becomes lower than f v , so that B 1 shown in 
the drawing is outputted from the matcher 20 as the 
brake command signal 21 and supplied to the braking 
device 22. 

[0184] The braking force corresponding to the com- 
mand is given to the electric motor vehicle from the brak- 
ing device 22 and the electric motor vehicle starts de- 
celeration. 

[0185] Assuming that the ATP command speed fre- 
quency f APT1 is changed to f ATP2 at the time t 2 , f ATP2 
becomes lower than f v , so that the brake command sig- 
nal 21 of the matcher 20 becomes B 2 as shown in the 
drawing and the electric motor vehicle decelerates fur- 
thermore. 

[0186] Assuming that the ATP command speed fre- 
quency is changed to f ATP3 to f ATP5 at the time t 3 to t 5 in 
the same way, B 3 to B 5 as shown in the drawing are 
outputted serially as the brake command signal 21 of 
the matcher 20. This brake command signal 21 is input- 
ted to the braking device 22 and the braking device 22 
gives the predetermined braking force to the electric mo- 
tor vehicle. 

[0187] In Fig. 1 , the brake command signals 21 B 1 to 
B 5 are outputted serially from the matcher 20 as shown 
in Fig. 3, so that the braking device 22 decodes them 
and the braking device 22 is controlled so that the brak- 
ing forces shown in Fig. 4 are operated. 
[01 88] As mentioned above, the ATP device is a main- 
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tenance device for giving braking force to an electric mo-, ■ 
tor vehicle by.an ATP command speed signal from the ; ;v 
* ground, controlling the speed of the electric motor vehi- 
cle, and stopping the electric motor vehicle at the pre- v 
determined stop position. v .5 

[0189] Namely, when one of the microcomputers 10 
and 11, the logic circuits 15and 16, and the matcher20 
constituting the ATP device breaks down and the pre- 
determined brake command is not outputted, a serious 
accident may be caused, so that jt is necessary to stop 10 
the electric motor vehicle surely when a failure of one of 
the aforementioned circuits and devices is detected. 
[0190] This failure detection function will be explained 
hereunder. ■ 

[0191] The control data 12 inputted to the logical cir- is 
cuit 15 of the system A is checked by the failure detector 
153 and the output signal 154 thereof is inputted to the 
failure detector of the system B. 

[0192] The control data 13 inputted to the logical cir- 
cuit 1 6 of the system B is checked by the failure detector 20 
163 and the output signal 164 thereof is inverted in sign 
by the inverter 19 and inputted to the failure detector 
153 of the system A as the sign inversion failure detec- 
tion signal 165. 

[0193] In this case, it is assumed that the signal volt- 25 
age level at which the circuit does not operate is L and 
the signal voltage level at which the circuit operates is H. 
[0194] When the control data 12 and 1 3 which are in- 
putted to the logic circuits 15 and 16 of the systems A 
and B are normal the output signals 154 and 164 of the 30 
failure detectors 153 and 1 63 become L. The output sig- 
nal 164 of the failure detector 163 of the system B is 
inverted in sign by the inverter 19, so that the sign in- 
version failure detection signal 165 becomes H. 
[01 95] As to CRC data inputted to the failure detector 35 
153 of the logical circuit 15, one of the two CRC data 
d crcio and D CRC11 ls selected by the H-level sign in- 
version failure detection signal 1 65 of the logic circuit 1 6 
and inputted to the failure detector 153 or the CRC data 
which is inputted first's changed to the other CRC data. 40 
For example, D CRC10 is controlled to be changed to 

D CRC1V 

[01 96] It is desirable that the data possessed by each 
CRC data is the same in each of the systems A and B. 
In this embodiment, it is a precondition that all the data 45 
are the same. Namely, the data Di 0 to Dl x . 1 of each of 
the CRC data D CRC10 , D CRC11 , D CRC20 , and D CRC21 are 
the same. 

[0197] On the other hand, CRC data inputted to the 
failure detector 1 63 of the logic circuit 1 6 is not changed so 
to the other CRC data because the failure detection sig- 
nal 154 is in the L state. 

[0198] The processing is started from this state. 
[0199] In this case, it is assumed that the CRC data 
of the control data 1 2 and 1 3 which are selected in each 55 
failure detector first is Dcrcio the system A and 
D CRC2 o in the system B. 

[0200] Fig. 5 shows the relation of the operation 
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waves between the number of operations r the output v "~ - '-0^ 7 0?k 
signal 154 of the failure detector 153, and the output ■ ", 
signal 164 of the failure detector 163;- J — : ' ? £ ^ "^'-;'VVv/ 
[0201] By the. first operation"-, the control' data 1 2 'from' * ;V V : ; >■ 4?^ 
the microcomputer 10 is supplied to the logic circuit 15 \ . -' ^'V " 

of the system A and the ATP command speed signal is 
converted to the predetermined command speed fre- 
quency f ATPn by the logic circuit 1 5 and outputted as the 
output signaM 7. . :V 
[0202] For the CRC data of this control data 12, : 
d crch which is incorrect CRC data is selected for the 
failure detector 153 by the H-level sign inversion failure 
detection signal 165 of the system B. Therefore, a failure 
is detected in the failure detector 1 53 and the failure de- 
tection signaM 54 becomes H. 

[0203] On the other hand, the control data 13 from the 
microcomputer 11 is supplied to the logic circuit 16 of 
the system B and the ATP command speed signal is 
converted to the predetermined command speed fre- 
quency f ATPn by the logic circuit 1 6 and outputted as the 
output signal 18. The CRC data of this control data 13 
is left unchanged as D CRC20 because the failure detec- 
tion signal 154 of the system A is in the previous state, ; 
that is, in the L state. Therefore, the failure detection 
signal 164 of the failure detector 163 is left unchanged 
at L and the sign inversion failure detection signal 165 
enters the H state. 

[0204] Namely, at the end of the first operation, the 
failure detection signal 1 54 of the system A becomes H 
and the failure detection signal 164 becomes L. 
[0205] By the second operation, the ATP command 
speed signal is converted to the predetermined com- 
mand speed frequency f ATPn and the output signals 17 
and 18 are left unchanged. However, for the CRC data 
of the control data 12 to be inputted to the logic circuit 
15 of the system A, D CRC11 is selected by the H-level 
sign inversion failure detection signal 1 65 of the system 
B and the failure detection signal 1 54 of the logic circuit 
15 is held in the H state as mentioned above. 
[0206] On the other hand, for the CRC data of the con- 
trol data 13 to be inputted to the logic circuit 16 of the 
system B, D CRC21 is selected by the failure detection 
signal 154 which is in the H state which is the final state 
of the first operation of the system A. 
[0207] Therefore, a failure is detected in the failure 
detector 163, and the failure detection signal 164 is 
changed from L to H, and the sign inversion failure de- 
tection signal 1 65 is changed from H to L. 
[0208] Namely, at the end of the second operation, the 
failure detection signal 154 of the system A becomes H 
and the failure detection signal 164 also becomes H. 
[0209] By the third operation, the ATP command 
speed signal is converted to the predetermined com- 
mand speed frequency f ATPn and the output signals 17 
and 18 are left unchanged. However, the CRC data of 
the system A is changed from D CRC11 to D CRC10 be- 
cause the sign inversion failure detection signal 165 of 
the system B is L. 
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[0210] Therefore^ the failure detection signal 154 of 
the logic circuit 1 5 is changed from H to L: : ''p\- : ''. 

[0211] On the other hand, for the CRC data of the con- :! 
trol data 13 to be inputted to the logic circuit 1 6 of the 
system B, D CRC21 is selected by the failure detection 5 
signali 54 which is in the H state which is the final state , 
of the second operation of the system A. 
[0212] Therefore, a failure is detected in the failure 
detector 163, and the failure detection signal 164 is left. . 
unchanged in the H state, and the sign inversion failure 10 
detection signal 165 is also left unchanged in the L sate. 
[0213] Namely, at the end of the third operation, the 
failure detection signal 154 of the system A becomes L 
and the failure detection signal 164 becomes H. 
[0214] By the fourth operation, the ATP command 15 
speed signal is converted to the predetermined com- 
mand speed frequency f ATPn and the output signals 17 
and 18 are left unchanged. However, since the sign in- 
version failure detection signal 165 of the system B to 
be inputted to the logic circuit 1 5 of the system A is L, -so 
the CRC data is left unchanged as D CRC10 . 
[021 5] Therefore, the failure detection signal 1 54 of 
the logic circuit 1 5 is left unchanged at L. 
[021 6] On the other hand, for the CRC data of the con- 
trol data 13 to be inputted to the logic circuit 16 of the 25 
system B, D CRC20 is selected because the failure detec- 
tion signal 1 54 of the system A is in the L state which is 
the final state of the third operation. 
[0217] Namely, the failure detection signal 164 is 
changed f rom H to L and the sign inversion failure de- 30 
tection signal 165 is changed from L to H. 
[0218] Namely, at the end of the fourth operation, the 
failure detection signal 1 54 of the system A becomes L 
and the failure detection signal 164 becomes L. 
[0219] By the fifth operation, the ATP command 35 
speed signal is converted to the predetermined com- 
mand speed frequency f ATPn and the output signals 17 
and 18 are left unchanged. However, since the sign in- 
version failure detection signal 165 of the system B to 
be inputted to the logic circuit 15 of the system A is H, *o 
for the CRC data, D CRC11 is selected. 
[0220] Therefore, the failure detection signal 154 of 
the logic circuit 1 5 is changed from L to H. 
[0221] On the other hand, forthe CRC data of the con- 
trol data 13 to be inputted to the logic circuit 16 of the <*5 
system B, D CRC20 is selected because the failure detec- 
tion signal 154 of the system A is in the L state which is 
the final state of the fourth operation. As a result, the 
failure detection signal 1 64 of the failure detector 1 63 is 
held in the L state and the sign inversion failure detection 50 
signal 165 is also held in the H state. 
[0222] The processing is returned to the first opera- 
tion status and then the above operations are repeated. 
[0223] In the aforementioned example, it is controlled 
so that when the failure detection signal 1 54 and the sign 55 
inversion failure detection signal 1 65 are in the L state, 
D CRC10 is selected in the system A and D CRC20 is se- 
lected in the system B and when they are in the H state, 




D CRC11 is selected in the system A and D CR C21 is se-N 
lected in the system B. The relation between the failure 
detection signal and control of selection of the CRC data 
may be changed variously depending on the applica- 
tion. . : ■} 
[0224] Although it is assumed that D CRC10 in the sys- 
tem A and D CRC20 in the system B are correct data of 
the CRC data and D CR<:m in the system A and D CRC21 
in the system B are incorrect data of the CRC data, they 
may be reversely assumed. In this case, correct and in- 
correct include that generation polynomial expressions 
of the CRC checker are different. 
[0225] As mentioned above, the CRC data D CRC2 of 
the system B is controlled by the failure detection signal 
1 54 of the logic circuit 1 5 of the system A and the CRC 
data D CRC1 of the system A is controlled by the sign in- 
version failure detection signal 165 of the failure detec- 
tion signal 1 64 of the logic circuit 16 of the system B. 
[0226] Therefore, when all the circuits such as the mi- 
crocomputers 10 and 11 and the logic circuits 15 and 16 
and the control data are normal, the failure detection sig- 
nals 154 and 164 alternate in the fixed period. 
[0227] By the way, the logic circuit 15, the failure de- 
tection signal 154, the logic circuit 16, and the failure 
detection signal 1 64 constitute a failure detection loop, 
so that a failure in this loop can be detected by a method 
for monitoring one of the failure detection signals 154 
and 164. 

[0228] However, a failure in a portion off this failure 
detection loop cannot be detected. To prevent ah incor- 
rect signal from outputting or a correct signal from not 
outputting due to a failure in a portion off this failure de- 
tection loop, the failure detection signal 154 of the sys- 
tem A and the failure detection signal 1 64 of the system 
B are collated by the matcher 20. 
[0229] Fig. 4 is a drawing showing that an electric mo- 
tor vehicle stops at the predetermined position and 
stops at the predetermined position by a brake com- 
mand B 5 and shows a brake command 21 and braking 
force when the brake is put off for starting, for example, 
the logic circuit 15 of the system A breaks down. 
[0230] When the alternation of the failure detection 
signal 154 of the system A and the failure detection sig- 
nal 164 of the system B is stopped, the alternation of a 
failure detection collation output signal 24 is stopped. 
As a result, an emergency brake signal EB is outputted 
from the braking device 21 so as to apply the maximum 
braking force to the electric motor vehicle. 
[0231] This emergency brake signal EB operates, as 
shown in Fig. 4, prior to the other brake commands B 1 
to B 5 . 

[0232] By monitoring the alternation of one of the fail- 
ure detection signals 1 54 and 1 64, it is possible to verify 
which one of the duplicated systems A and B breaks 
down, and the failure can be analyzed easily, and a fail 
safe system can be constructed effectively. 
[0233] Fig. 6 shows a 1-bit fail safe matcher and Fig. 
7 shows the operation waveforms thereof. 
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• [0234] In Fig .6, numeral 100 indicates a sign inverter; 
101 a first flip-flop, 102 a second flip-flop, 103 an exclu- 
sive OR gate, 104 a collation output signal, 154 the fail- 
ure detection signal of the logic circuit 15 shown in Fig. 
1 , and 1 64 the failure detection signal of the logic circuit 
16 shown in Fig. 1. 

[0235] Since the failure detection signals 154 and 164 
alternate in the fixed period, the failure detection signal 
154 is inputted to a clock terminal CK 1 of the first flip- 
flop 101. 

[0236] When the failure detection signal .1 64 is invert-, 
ed in sign by the inverter 1 00 and inputted to a clock 
terminal CK 2 of the second flip-flop 102, an output Q n 
of the first flip-flop 1 01 and a negative (inverted) output 
Q 2 of the second flip-flop 102 are formed as shown in 
Fig. 6. 

[0237] When the output Q 1 of the first flip-flop 101 and 
the negative output Q 2 of the second flip-flop 102 are 
inputted to the exclusive OR gate 103, as shown in Fig. 
6, the exclusive OR output signal 1 04 can be obtained. 
[0238] When the alternation of one of the failure de- 
tection signals 1 54 and 1 64 is stopped or one of the flip- 
flops breaks down and the output terminal thereof is 
fixed to H or L, the alternation of the output signal 1 04 
of the exclusive OR gate 103 is stopped. 
[0239] Since the matcher collates two signals surely, 
the outputs thereof always alternate in the normal state. 
Therefore, by monitoring the output signal 1 04, not only 
the loop of the systems A and B but also the whole ATP 
device can be decided as to whether they are normal or 
abnormal. Conversely speaking, it is desirable to mon- 
itor only this output signal 104. 

[0240] . Fig. 6 shows a fail safe matcher for collating a 
1-bit output. To collate a plurality of bits in fail safe, it is 
desirable to prepare only the circuit collating drawing 
shown in Fig. 6. The matcher 20 shown in Fig. 1 is equiv- 
alent to that the circuit shown in Fig. 6 has a plurality of 
bits built-in. 

[0241] Therefore, it is desirable that a controller or a 
system lor. receiving an output signal from the ATP de- 
vice has a constitution for outputting an emergency con- 
trol signal because the outputting of alternating signals 
of the matcher 20 is stopped and it is made possible to 
construct a system for realizing fail safe surely by this 
constitution. 

[0242] The aforementioned is an explanation of an 
embodiment in which the brake command 21 of the 
matcher 20 is outputted serially. However, it is possible 
that , B 2 , B 3 . B 4 , and B 5 of the brake command 21 are 
outputted to the braking device 22 respectively in paral- 
lel. In other words, it is desirable that the matcher 20 is 
structured so that the command becomes a signal nec- 
essary for the braking device 22. 

[0243] As mentioned above, when a memory retain- 
ing control data is not built in the microcomputer but in 
the ATP device or it is installed independently, a dedi- 
cated memory reading signal line, a writing signal con- 
trol circuit, and an address signal generation circuit are 
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the controller only transmit and receive information via 
the memory and the microcomputer can be used for oth- , 
er control processing, so that the use efficiency of the : ; 
microcomputer can be increased. • ; 
[0244] in this embodiment, an example in which there 
are two CRC data provided for one logic circuit and they 
are switched by a failure detection signal from another 
logic circuit. However, as mentioned in Fig. 18, it can be 
realized easily that the content of the data is not 
checked, and just alternating signals are generated, and 
whether the two logic circuits operate normally or abnor- 
mally is outputted. 

[0245] Next, another embodiment will be explained . 
with reference to Fig. 8. 

[0246] In Fig. 8, as in Fig. 1 /the same circuit is mount- 
ed on one chip as duplicated as the systems A and B. 
As mentioned above, the ATP device is a maintenance 
device necessary for safety running of an electric motor 
vehicle and it is never permitted that an incorrect signal 
is outputted or the predetermined signal is not outputted 
due to a failure in the ATP device. Therefore, the failure 
detection function in the embodiment shown in Fig. 8 is 
strengthened furthermore. 

[0247] In Fig. 8, each same code as that shown in Fig. 
1 has the same function, so that the explanation thereof 
will be omitted. ' 
[0248] In Fig. 8, numeral 30 indicates a first memory 
mounted in the logic circuit 15 of the system A, 31 a 
second memory, 32 CRC data of control data 1 20 stored 
in the first memory 30, 33 CRC data of control data 121 
stored in the second memory 31 , 34 a switching circuit 
for the first memory 30 and the second memory 31 , 35 
an output signal of the memory switching circuit 34, 36 
a first CRC check circuit for the control data 1 20 stored 
in the first memory 30, 37 a second CRC check circuit 
for the control data 121 stored in the second memory 
31 , 38 a first OR circuit for adding the output signal 35 
of the switching circuit 34 and, an output signal of the 
second CRC check circuit 37, and 39 a second OR cir- . 
cuit for adding an output signal of the first CRC check 
circuit 36 and the speed frequency 5 corresponding to 
the running speed of an electric motor vehicle. 
[0249] Numeral 40 indicates a first memory mounted 
in the logic circuit 1 6 of the system B, 41 a second mem-: 
ory, 42 CRC data of control data 130 stored in the first 
memory 40, 43 CRC data of control data 131 stored in 
the second memory 41 , 44 a switching circuit for the first 
memory 40 and the second memory 41, 45 an output 
signal of the memory switching circuit 44, 46 a first CRC 
check circuit for the control data 130 stored in the first 
memory 40, 47 a second CRC check circuit for the con- 
trol data 131 stored in the second memory 41 , 48 a first 
OR circuit for adding the output signal 45 of the switch- 
ing circuit 44 and an output signal of the second CRC 
check circuit 47, and 49 a second OR circuit for adding 
an output signal of the first C RC check circuit 46 and the 
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- speed frequency 5 corresponding to the running speed * 
of an electric motor vehicle: : : • y K>" 
[0250] The ATP command speed signal 8 is proc-, 
essed by the microcomputers 1 0 and 1 1 and the respec- 
tive control data is inputted to the logic circuits of the 
systems A and B of the 1 -chip logic element 14. 
[0251 J Namely, the first control data 120 from the mi- 
crocomputer 1 0 is stored jn the first memory 30 of the 
system A, and the second control data 121 is stored in 
the second memory 31 of the system A, and the third 
control data 130 from the microcomputer 11 is stored in 
the first memory 40 of the system B, and the second 
control data 131 is stored in the second memory 41 of 
the system B. 

[0252] Fig. 9 shows data which is stored in the mem- 
ories 30, 31, 40, and 41 from the microcomputers 10 
and 11. 

[0253] The microcomputer 10 converts the ATP com- 
mand speed signal 5 to n-word data D ox to D 14X , proc- 
esses and obtains the CRC data 32 (data is D CRCX1 ) of 
the data D ox to D 14X when the generation polynomial 
expression is set to G0(X) at the same time, and stores 
the data in (1) shown in Fig. 9 in which the CRC data 32 
(data is D CRCX1 ) is added to the data D ox to D 14X at the 
addresses AOS to A1 5S of the first memory 30. 
[0254] The microcomputer 1 0 processes and obtains 
the CRC data 33 (data is D CRCX2 ) of the data D ox to 
D 14X when the generation polynomial expression is set 
to G1(X) and stores the data in (2) shown in Fig. 9 in 
which the CRC data 33 (data is D CRCX2 ) is added to the 
data D ox to D 14X at the addresses AOT to A15T of the 
second memory 31 . 

[0255] The microcomputer 11 converts the ATP com- 
mand speed signal 5 to n-word data D 0Y to D 14Y , proc- 
esses and obtains the CRC data 42 (data is D CRCY1 ) of 
the data D 0Y to D 14Y when the generation polynomial 
expression is set to G2(X) at the same time, and stores 
the data in (3) shown in Fig. 9 in which the CRC data 42 
(data is D CRCY1 ) is added to the data D 0Y to D 14Y at the 
addresses AOU to A15U of the first memory 40. 
[0256] The microcomputer 11 processes and obtains 
the CRC data 43 (data is D CRCY2 ) of the data D 0Y to 
D 14Y when the generation polynomial expression is set 
to G3(X) and stores the data in (4) shown in Fig. 9 in 
which the CRC data 43 (data is D CRCY2 ) is added to the 
data D 0Y to D 14Y at the addresses AOV to A15V of the 
second memory 41 . 

[0257] The data which is stored at the addresses AOS 
to A15S of the first memory 30 of the system A and the 
addresses AOT to A15T of the second memory 31 are 
converted from parallel to serial, read sequentially from 
the low-order bits to the high-order bits, and inputted to 
the switching circuit 34. 

[0258] In the same way, the data which is stored at 
the addresses AOU to A15U of the first memory 40 of 
the system B and the addresses AOV to A15V of the 
second memory 41 are converted from parallel to serial, 
read sequentially from the loworder bits to the high-or- 



>3 : • der bits, and inputted to the switching circuit 171' , ! 

[0259] The period from reading the addresses AOri to 
A15n to processing by the frequency comparators 152 
and 162 is one processing period. . - 

S [0260] The first CRC check circuit 36 of the system A 
is a circuit corresponding to the generation polynomial 
expression G0(X) and the second CRC check circuit 37 
is a circuit corresponding to the generation polynomial , 
expression G1(X). " 
10 [0261] The third CRC check circuit 46 of the system 
B is a circuit corresponding to the generation polynomial 
expression G2(X) and the fourth CRC check circuit 47 
is a circuit corresponding to the generation polynomial 
expression G3(X). 
is [0262] It is assumed that the failure detection signal 
154 of the system A and the failure detection signal 164 
of the system B are in the L state first. Therefore, the 
sign inversion failure detection signal 1 65 of the system 
BisH. 

20 [0263] By this H-state sign inversion signal 1 65 of the 
system B, the switching circuit 34 of the system A is 
switched to the side for reading the data of the first mem- 
ory 30, and the switching circuit 44 of the system B is 
switched to the side for reading the data of the second 

25 memory 41 by the L-state sign inversion signal 1 54 of 
the system A, and all the data and the internal circuit are 
assumed to be normal. 

[0264] The data D ox to D 14X at the addresses AOS to 
A14S of the first memory 30 of the system A and the 

30 data D ox to D 14X at the addresses AOT to A14T of the 
second memory 31 are inputted to the frequency con- 
verter 150 via the switching circuit 34 and the first logic 
circuit 38 and converted to the ATP command speed fre- 
quency f m corresponding to the respective data, where- 

35 as the the data D ox to D1 4X at the addresses AOS to 
A14S and AOT to A14T are inputted to the first CRC 
check circuit 36 and the second CRC check circuit 37 
and checked by the CRC data D CRCX1 and D CRCX2 at 
the addresses A15S and A15T. 

40 [0265] Therefore, it is structured so that until the CRC 
data D CRCX1 and D CRCX2 at the addresses A15S and 
A15T are all read and checked, the intermediate check 
result for the first check circuit 36 and the second check 
circuit 37 is not outputted. 

45 [0266] The CRC data D CRCX1 and D CRCX2 at the ad- 
dresses A15S and A15T are structured not to be fre- 
quency-converted. 

[0267] In the same way, the data D 0Y to D 14Y at the 
addresses AOU to A14U of the first memory 40 of the 

50 system B and the data D 0Y to D 14Y at the addresses AOV 
to A14V of the second memory 41 are inputted to the 
frequency converter 1 60 via the switching circuit 44 and 
the first logic circuit 48 and converted to the ATP com- 
mand speed frequency f m corresponding to the respec- 

55 tive data, whereas the the data D 0Y to D 14Y at the ad- 
dresses AOU to A14U and AOV to A14V are inputted to 
the first CRC check circuit 46 and the second CRC 
check circuit 47 and checked by the CRC data D CRCY1 
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\ ~; and Dcrcy2 at -the addresses A1 5U and AI 5V^%:r^ 
[0268] Therefore, it is structured so that until the CrtC : ^ .V 
data D CRCY1 and D CRC Y2 at the addresses A15U and ; 
A 15V are all read and checked, the intermediate checks 
result for the first check circuit 46 and the second check- : < 5 
circuit 47 is not outputted. < > ' - 

[0269] The CRC data D CRCY and D CRCY2 at the ad- 
dresses A 15U and A15V are structured not to be fre- 
quency-converted. ... 
[0270] Firstly, the one-word data at the address AOS . io 
of the first memory 30 of the system A is inputted to the ") 
frequency converter 1 50 via the OR circuit and convert- 
ed to the ATP command speed frequency frO corre- 
sponding to the one-word data. 

[0271] On the other hand, since the first CRC check . 15 
circuit 36 and the second CRC check circuit 37 are 
checking data, the outputs thereof are L. 
[0272] Next, the one-word data at the address AIS is 
inputted to the frequency converter 150 via the OR cir- 
cuit 38 and converted to the ATP command speed fre- 20 
quency f r1 corresponding to the one-word data at the 
address A1S. On the other hand : the input frequency f H 
which is an output of the OR circuit 39 is L. 
[0273] Hereafter, in the same way, each one-word da- 
ta is converted to the ATP command speed frequency 25 
f r14 corresponding to the data up to the address A14S. 
[0274] The one-word CRC data D CRCX1 (data by the 
generation polynomial expression G0(X)) at the last ad- 
dress A1 5S is decided as normal by the first CRC check 
circuit 36 (circuit corresponding to the generation poly- 30 
nomial expression G0(X)), so that the output thereof is 
L. However, since the one-word CRC data D CRCX1 is 
decided as abnormal by the second CRC check circuit 
37 (circuit corresponding to the generation polynomial 
expression G1 (X)), the output thereof is H. 35 
[0275] The output of this second CRC check circuit is 
inputted to the frequency converter 150 as maximum 
data via the OR circuit 38 and converted to the maximum 
frequency f r15 . 

[0276] On the other hand, the input frequency f j15 40 
which is an output of the OR circuit 39 is L. 
[0277] The frequency f m corresponding to the data at 
each address which is obtained in this way and the input 
frequency f in are compared by the frequency compara- 
tor 1 52. . . 45 
[0278] In the frequency comparator 152, when the re- 
lation between the ATP command speed frequency frn 
and the addition frequency f in is f m > f jn , 1 is added to 
- the internal counter value (not shown in the drawing), 
and when the relation is f m < f jn , 1 is subtracted from the 50 
counter value, and when f m = f in , nothing is added to or 
subtracted from the counter value. 
[0279] In the first processing period, 1 is added to the 
counter value in correspondence to the addresses AOS 
to A14S. In the second processing period, the data is 55 
read from the address AOS again and the counter value 
of the frequency comparator 1 52 is incremented by the 
same operation as that mentioned above. f ; . 
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[0280] When the fourth processing period elapses' r i ; 
k and the counter value of the frequency comparator ^^^f^-^iS^ 
reaches 4, the output signal 1 7 corresponding to : eacrv ^ ; ^^> v ^ ''■ 
of the addresses from AOS to A15S is obtained. ; 4 
[0281] Fig. 1 0 shows the relation between the operas "7* v 
,. tion of the counter of the frequency comparator 1 52 due 
to the CRC check result at the address A15S of the sys-i 
tern A, the operation of the counter of the frequency 
comparator i 62 due to the CRC check result at the ad- 
dress A15U of the system B, and the sign inversion sig- 
nal 165 which inverts the sign of the failure detection 
signal 1 64. 

[0282] When the counter value reaches 4 by an up- 
count pulse, the output signal 17 of the frequency com- 
parator 152 is obtained. Since this output signal 17 is 
outputted serially, the frequency comparator 152 de^ 
tects the H-state failure detection signal 154 corre- 
sponding to the address A15S in synchronization with 
the timing signal (not shown in the drawing) and inputs 
it to the memory switching circuit 44 of the system B. 
[0283] The switching circuit 44 switches the. memory 

41 to the memory 40 in exact timing with the beginning 
of the next processing period, so that the memory of the 
system B is actually switched at the beginning of the 
sixth processing period. 

[0284] The data stored at the addresses AOU to A1 4U 
of the memory 40 is exactly the same as the data stored 
at the addresses AOV to A14V of the memory 41 , so 
that even if the memory 41 is switched to the memory 
40, the ATP command speed frequency f m will not be 
changed and the input frequency f in will not be changed. 
[0285] Therefore, the output frequency of the frequen- 
cy converter 160 will not be changed. Only the CRC data 

42 ( d crcyi) stored at the address A15U and the CRC 
data 43 (D CRCY2 ) stored at the address A1 5V are differ- 
ent, so that the operation when the data at the address- 
es A15U and A15V are read will be explained. 
[0286] When the memory 41 is switched to the mem- 
ory 40, the CRC data 42 (data by the generation poly- 
nomial expression) is read. Since the CRC data 42 is 
decided as normal by the first CRC check circuit 46 (cir- 
cuit corresponding to the generation polynomial expres- 
sion G2(X)), the output thereof is L. However, since it is 
decided as abnormal by the second CRC check circuit 
47 (circuit corresponding to the generation polynomial 
expression G3(X)), the output thereof is H. 
[0287] Since the output of the first CRC check circuit 
46 is L, the output of the OR circuit 49 is also L and the 
input frequency f i15 is also L. 

[0288] On the other hand, the H-state output of the 
second CRC check circuit 47 is inputted to the frequency 
converter 1 60 via the OR circuit 48 and converted to the 
maximum frequency f rl5 . 

[0289] This maximum frequency f r15 and the input fre- 
quency f i15 are inputted and compared by the frequency 
comparator 162. Since the relation between the maxi- 
mum frequency f r15 and the input frequency f j15 is f r15 



5 , the counter value of the frequency comparator 162 
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is incremented to 1 1 ^ •>;'". . . : >■'■ ; •;• ]'«"'\ :{'< .' ;^ v-vrc 
[0290] Hereafter, by the same operation as that of the ■ 
system A, the counter value of the frequency compara- 
tor 162 is incremented and when the counter value 
reaches 4, the output signal 18 corresponding to each 
of the addresses from AOU to A15U is obtained. 
[0291] The frequency comparator 162 detects the in- 
state failure detection signal 164 corresponding to the 
address A15U of this output signal 18 in synchronization 
with the timing signal (not shown in the drawing) and 
adds the L-state sign inversion signal 165 which is in- 
verted in sign by the inverter 1 9 to the memory switching 
circuit 34 of the system A. 

[0292] When the sign inversion signal 1 65 is inputted, 
the memory switching circuit 34 of the system A switch- 
es the memory 30 to the memory 31 from the next 11th 
period. 

[0293] Only the CRC data 32 (D CR q X1 ) stored at the 
address A15S and the CRC data 33 (D CRCX2 ) stored at 
the address A1 5T are different between the memory 30 
and the memory 31, so that the frequency will not be 
changed when the memory is switched as mentioned 
above. 

[0294] Since the CRC data 33 of the memory 31 is 
data by the generation polynomial expression G1 (X), it 
is decided as abnormal by the CRC check circuit 36 and 
the output signal thereof becomes H. This output signal 
is inputted to the frequency converter 152 as a maxi- 
mum frequency f h 5 via the second OR circuit 39. 
[0295] On the other hand, since the CRC data 33 of 
the memory 31 is data by the generation polynomial ex- 
pression G1 (X), it is decided as normal by the CRC 
check circuit 37, and the output signal thereof becomes 
L ; and the output signal of the OR circuit 38 also be- 
comes L, and the reference frequency f r15 of the fre- 
quency converter 150 also becomes L. 
[0296] Therefore, the relation between the reference 
frequency f r15 and the input frequency f i15 becomes f rl5 
< f i15 and a count-down pulse is given, so that 1 is sub- 
tracted from the counter value of the frequency compa- 
rator 152 and the counter value is changed from 4 to 3. 
[0297] When the counter value of the frequency com- 
parator 152 becomes 0, the output signal 17 of the fre- 
quency comparator 152 also becomes L and the failure 
detection signal 1 54 corresponding to the address A1 5T 
becomes L. 

[0298] By the same operation hereafter, the memory 
of the opposite system is switched alternately by a fail- 
ure detection signal of the frequency comparator of the 
own system. 

[0299] When the memories 30 and 31 of the system 
A, data read from them, the two CRC check circuits 36 
and 37, the memories 40 and 41 of the system B, data 
read from them, and the two CRC check circuits 46 and 
47 are normal as mentioned above, the failure detection 
signals 1 54 and 1 64 change alternately to H or L respec- 
tively whenever the memory is changed. 
[0300] For example, when an error occurs in the data 



C of the memory 30 of the system A; the following is 
> • caused. The data error of the memory 30 is detected by 
the CRC check circuit 36 and the output signal thereof 
becomes H. " '-V, 

5 [0301] On the other hand, CRC data by a different 
generation polynomial expression is inputted to the 
CRC check circuit 37 from the beginning, so that the out- 
put signal thereof also becomes H. Namely, since the 
output signals of both the check circuits become H ; nei- 
10 ther the counter value of the frequency comparator 1 52 
nor the output will be changed. 

[0302] Therefore, the failure detection signal 154 for 
switching the memory 41 of the system B to the memory 
41 is fixed to H or L which is the state when a failure 
15 occurs and the memory cannot be switched from 41 to 
40. 

[0303] As a result, the counter value of the frequency 
comparator 162 will not be incremented and the failure 
detection signal is fixed to the L state. Therefore, the 
20 sign inversion failure detection signal 1 65 is fixed to H, 
and the memory 30 of the system A is not switched to 
the memory 31 , and the output signals of the CRC check 
circuits 36 and 37 are fixed to H. 

[0304] The above is an example when an error occurs 

25 in data. However, when one of the circuits breaks down, 
the counter values of the frequency comparators 152 
and 162 are fixed as a result and the alternation of the 
failure detection signals 1 54 and 1 64 is stopped, so that 
it is desirable to monitor the alternation of the failure de- 

30 tection signals 1 54 and 1 64. 

[0305] When such a method for generating a signal is 
applied to the ATP device of a train, it can be used as a 
means for commanding an emergency brake when the 
alternation of the failure detection signals 154 and 164 

35 js stopped. 

[0306] When this circuit comprises an LSI and is inte- 
grated to one chip including the peripheral circuit, mini- 
aturization and mass production can be realized with the 
reliability as an ATP device kept. 

40 [0307] Since the ATP device constitutes a failure de- 
tection loop together with the failure detection signal 154 
and the failure detection signal 164 as mentioned 
above, a failure within the loop can be detected by mon- 
itoring one of the failure detection signals 154 and 1 64, 

45 though a failure in a position off this failure detection loop 
cannot be detected. To prevent an incorrect signal from 
being outputted or a correct signal from not being out- 
putted due to a failure in a position off this failure detec- 
tion loop, the failure detection signals 154 and 164 are 

50 collated by the matcher 20, and when a match occurs, 
the matcher 20 outputs a signal, and when a mismatch 
occurs, the matcher 20 outputs an emergency control 
signal. 

[0308] The matcher 20 compares the output signal 1 7 
55 of the frequency comparator 1 52 of the system A and 
the output signal 1 8 of the frequency comparator 1 62 of 
the system B. As mentioned above, since the output sig- 
nal 17 and the output signal 18 are outputted serially in 
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and outputs only a matched sighaj. When a mismatch 
occurs, the matcher 20 can output an emergency control 
signal or display it on the display unit. r - :. : : • 
[0309] Therefore, by using this constitution, a fail safe 
system can be constructed. 

[0310] As mentioned above, according to the present 
invention, two CRC data in which different generation 
polynomial expressions are applied to one data are pre^ 
pared, and two systems of control data to which the CRC 
data are added are produced, and two kinds of check 
circuits corresponding to different generation polynomi- 
al expressions are provided. 

[0311 J This is a method for inputting the two systems 
of control data to the two kinds of check circuits at the 
same time and switching the two systems of data using 
the result obtained by comparing the outputs of the two 
kinds of check circuits. 

[031 2] Therefore, an error can be detected not only in 
the data but also in the check circuits and furthermore 
outputs are collated and only when a match occurs, they 
can be outputted. There is an advantage that a fail safe 
system can be structured more surely by using a chip 
in which each of the circuits comprises an LSI. 
[031 3] Next, the operation of the frequency converter 
150 (1 60) shown in Figs. 1 and 8 will be explained here^ 
under. 

[0314] Fig. 11 shows a frequency converter for con- 
verting digital data to a frequency and Fig. 12 is a flow 
chart of the operation of the frequency converter. 
[0315] In Fig. 11 . numeral 50 indicates a memory, 51 
a clock signal C N , 52 a data register, 53 an output signal 
of the data register 52, 54 all 1 -bit adders, 55 an addition 
output of all the adders 54, 56 a clock signal C P , 57 a 
processing shift register, 58 an output signal of the shift 
register 57, 59 a first flip-flop for timing adjustment, 60 
an output signal of the flip-flop 59, 61 a carrier output 
signal of all the adders 54, 62 a second flip-flop for hold- 
ing the carrier output signal 61 , 63 an output signal of 
the flip-flop 62, 64 a timing signal, 65 an AND circuit for 
removing the predetermined output signal from the car- 
rier output signal 61 , and 66 an output signal of the fre- 
quency converter. 

[0316] For simple explanation of the operation, it is 
assumed that the data length is 4 bits, and data of the 
same value is periodically read from the memory 50, and 
data of the data register 52. and the shift register 57 is 
shifted in the direction of the arrow shown on the upper 
part. 

[0317] The clock signal C N 51 and the clock signal 

Cp56 are clock signals which are different in phase by 

90° as shown in (1) and (2) in Fig. 12. 

[0318] In the initial state, the initial values of the data 

register 52 and the shift register 57 are 02 (this means 

that the data value in binary is zero). 

[0319] It is assumed that the data value 82 (the data 

value in binary is 8) as shown in (3) in Fig. 12 is read at 
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, the leading edge of the clock signal Cp56 from the^mem^S 
ory 50. Since this data is set in the data register 52 at, 
the leading edge of the clock signal C N 51 , the most sig- 
nificant DR 3 bit to the least significant DR$ bit are set as 
shown in" (4) in Fig. 12. V . 

[0320] When the data in (4) shown in Fig. 12isshifted 
four times at the leading edge of the clock signal C N 51 , 
the value of the least significant DR 0 bit of the data reg- 
ister 52 is set as shown in (7) in Fig. 12 and added to 
the input terminal A of ail the adders 54 as the output 
signal 53. 

[0321 ] In this case, the output signal 60 of the first flip- 
flop 59 and the output signal 63 of the second flip-flop 
62 are not added to the input terminals B and C of all 
the adders 54, so that the output signal 55 at the . addition ■ 
output terminal L of ail the adders 54 becomes H as 
shown in (8) in Fig. 12 and is added to the shift register 
57. The output signal 61 at the carrier output terminal 
C r of all the adders 54 becomes L as shown in (14) in 
Fig. 12. 

[0322] Since the output signal 55 of all the adders 54 
is set in the shift register 57 at the leading edge of the 
clock signal Cp56 shown in (2) in Fig. 12, the most least 
bit SRq of the shift register 57 is set as shown in (9) in 
Fig. 12. . ^ . 

[0323] The data value 82 (8 in decimal) is read from 
the memory 50 at the leading edge of the same clock 
signal C P 56 and shifted on the data register 52 at the 
leading edge of the clock signal C N 51 . 
[0324] On the other hand, the data of the least signif- 
icant bit SR 0 of the shift register 57 is shifted on the shift 
register 57 at the leading edge of the clock signal Cp56; 
and the most significant bit SR 3 becomes H in the middle 
of the 7th shift, and the output signal 58 of the shift reg- 
ister 57 becomes H. 

[0325] Since the output signal 58 is set in the first flip- 
flop 59 at the leading edge of the clock signal C P 56, the 
output signal 60 thereof becomes H at the 8th shift as 
shown in (13) in Fig. 12 and is inputted to the input ter- 
minal B of all the adders 54. 

[0326] On the other hand, the least significant bit DR 0 
of the data register 52 also becomes H at the 8th shift 
and is inputted to the input terminal A of all the adders 
54. 

[0327] As a result, the output signal 55 at the addition 
output terminal Z of all the adders 54 becomes L, though 
the output signal 61 of the carrier output terminal C r be- 
comes H. This output signal 61 is set in the second flip- 
flop at the leading edge of the next clock signal C N 51 
and the output signal 63 shown in (15) in Fig. 12 is in- 
putted to the input terminal C of all the adders 54. 
[0328] Therefore, the output signal 55 of the addition 
output terminal L of all the adders 54 becomes H and is 
shifted on the shift register 57. 

[0329] Since the operation explained above is repeat- 
ed periodically, the data shown in Fig. 12 move around 
in the data register 52 and the shift register 57. By add- 
ing the carrier output signal 61 of all the adders 54 which 
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is generated at this time to the AND gate and fetching it; y v When P < Mi the output signal 80 ,- l>feo^e¥K^;)?ASSi 
by the timing signal 64, the output signal 66 in the fixed ; [0336] , When a mu|ti-f requency is compared, the boh- 
period as shown in (16) in Fig. 12 can be obtained. stitution shown in Fig. 15 is used/In Fig. 15, numeral 90 
[0330] The above is the explanation of the operation indicates a shift register having the number of bits equiv- 
when one kind of digital data is converted to one fre- 5 alent to a length of 4 bits which is equivalent to the flip- 
quency. To obtain two kinds of frequencies, different da- flops 70 to 73 shown in Fig. 1 3 and 91 indicates an adder 
ta are read and processed alternately from the memory having a function for allowing data on the shift register 
50. Therefore, it is desirable to double the number of 90 to perform the same operation as the inversion of the 
bits of the shift register 57 to 8 bits and prepare two AND flip-flops 70 to 73 shown in Fig. 13. 
gates and a timing signal so as to take out the predeter- 10 [0337] A symbol ^ indicates a time slot in which 4 bits 
mined frequency from the carrier output signal 61 of all are grouped and the slot inputs the signal P to the +A 
the adders 54. By changing the bit length of the shift terminal of the adder 91 and inputs the signal M to the 
register 57 like this, the frequency converter shown in -C terminal. It is assumed that P > M. 
Fig. 10 can generate a multi-frequency. [0338] The frequency comparison operation com- 
[0331] Next, the frequency comparison operation *5 pares the presence or absence of a pulse, so that P = 
shown in Figs. 1 and 8 will be explained. A frequency H and M = L in this state. Since the sign inversion signal 
comparator is shown in Fig. 1 3 and an operation timing H of M is inputted to the -C terminal and added, the car- 
chart is shown in Fig. 14. In Fig. 13, numerals 70 to 73 rier output C r becomes H and this value is added to the 
indicate flip-flops, 74 to 79 AND gates, P and M input l 0 slot of the shift register 90. 

frequency signals to be compared, and 80 an output sig- 20 [0339] The data of this 10 slot moves around on the 

nal of the frequency comparison result. shift register, is inputted to the +B terminal of the adder 

[0332] For example, when the P signal is inputted, it 91 at the l 0 slot in the next period, and added together 

inverts and operates one of those among the flip-flops with the P input and the M input, so that the carrier output 

70 to 73 which are closest to the input to Q = H and when C r of the adder becomes H also in this case and the data 

the M signal is inputted inversely, it inverts and operates 25 of the same value as the previous one moves around 

one of those among the flip-flops 70 to 73 which are Q on the shift register 90. 

= H and closest to the input to Q = L. [0340] When P < M, a signal L in which the signs of P 

[0333] When theinput signal P is inputted continuous- = L and M = H are inverted is added, so that the carrier 

ly as shown in Fig. 14, the flip-flop 70 operates in syn- output C r becomes L, that is, is subtracted and the value 

chronization with the trailing edge of the first pulse P 1 of 30 j s added to the l 0 slot of the shift register 90. Namely, L 

the signal P and Q 0 becomes H, and when the second moves around on the shift register 90. 

pulse P 2 is inputted, the flip-flop 71 operates in synchro- [0341] When P == M = H, a signal L in which the signs 

nization with the trailing edge of the output of the AND of P = L and M = H are inverted is added. However, the 

gate 74 and Q n becomes H, and when the third pulse value of the carrier output C r varies with the data of the 

P 3 is inputted, the flip-flop 72 operates in synchroniza- 35 | 0 slot which moves around on the shift register 90. 

tion with the trailing edge of the output of the AND gate When the data of the l 0 slot is L, the carrier output C r 

76 and Q 2 becomes H, and when the fourth pulse P 4 of also becomes L and when the data of the l 0 slot is H, 

the signal P is inputted, the flip-flop 73 operates in syn- the carrieroutput C r becomes H Namely, the data of the 

chronization with the trailing edge of the output of the l 0 slot moving around on the shift register 90 will not be 

'AND gate 78 and Q 3 becomes H. 40 changed. 

[0334] When the input signal M is inputted continu- [0342] When P = M = L, a signal H in which the signs 

ously, the flip-flop 70 operates in synchronization with of P = L and M = H are inverted is added. Also in this 

the trailing edge of the first pulse M n of the signal M and case, the value of the carrier output C r varies with the 

Q 0 is changed from H to L, and when the second pulse data of the l 0 slot which moves around on the shift reg- 

M 2 is inputted, the flip-flop 71 operates in synchroniza- *5 j S ter 90. When the data of the l 0 slot is L, the carrier 

tion with the trailing edge of the AND gate 75 and Q., is output C r also becomes L and when the data of the l 0 

changed from H to L, and when the third pulse M 3 is slot is H, the carrieroutput C r becomes H. Namely, the 

inputted, the flip-flop 72 operates in synchronization with data of the l 0 slot moving around on the shift register 90 

the trailing edge of the AND gate 77 and Q 2 is changed will not be changed. 

from H to L, and when the fourth pulse M 4 is inputted, 50 [0343] The frequency comparison operation is per- 

the flip-flop 73 operates in synchronization with the trail- formed by this method. 

ing edge of the AND gate 79 and Q 3 is changed from H [0344] Fig. 16 shows another embodiment of the 

t0 L - present invention. According to the embodiment shown 

[0335] As mentioned above, when the number of "in Fig. 8, the system A has two circuits of the memories 

pulses is large, the output state of the flip-flop on the 55 30 and 31 in the logic circuit 15 and the output data 35 

subsequent stage can be inverted and when P > M, Q 3 is obtained by selecting data outputted from each mem- 

of the flip-flop FF 3 becomes H, that is, the output signal ory by the switching circuit 34. Also the system B has 

80 of the frequency comparison result becomes H. two circuits of the memories 40 and 41 in the logic circuit 
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; 1 6 and;the outputdata 45;is obtained By selecting ^ 
; outputted froiri each memory by the sy/itching circuit 44 
: [0345] x A difference of the embodiment of the.present 
invention, shown in Fig. 16 from that shown in Fig. 8 is 
that each of memories in the logic circuits 15 and 16 of 
the systems A and B comprises one circuit and the CRC 
data allocated at the last address of each memory is 
stored in another area and switched by the aforemen- 
tioned failure detection signal. 

[0346] Namely, the CRC data D CRCX1 which is calcu- 
lated by the microcomputer 1 0 by the same method as 
the aforementioned is stored in the memory 32 of the 
system A, and D CRCX2 is stored in the memory 33, and 
d crcyi which is calculated by the microcomputer 11 is 
. stored in the memory 42 of the system B, and D CRCY2 
is stored in the memory 43. 

[0347] In the system A, the data read from the mem- 
ory 30 is added to the CRC data 32 by the logic circuit 
200, and the data read from the memory 30 is added to 
the CRC data 33 by the logic circuit 201 , and they are 
inputted to the switching circuit 34.. 
[0348] In the system B, the data read from the mem- 
ory 40 is added to the CRC data 42 by the logic circuit 
202, and the data read from the memory 40 is added to 
the CRC data 43 by the logic circuit 203, and they are 
inputted to the switching circuit 44. The switching timing 
for the switching circuits 34 and 44 is the same as the 
aforementioned. 

[0349] . In another embodiment of the present inven- 
tion shown in Fig. 1 6, the number of memories requiring 
the maximum number of gates can be reduced by half, 
so that it not only greatly contributes to improvement of 
the reliability but also has a great effect on reduction of 
power consumption of the LSI. 

[0350] Fig. 17 shows another embodiment of the 
present invention. Fig. 17 also shows an example in 
which each built-in memory comprises one circuit. A dif- 
ference between Fig. 8 and Fig. 16 is that although the 
output of each memory is switched by the switching cir- 
cuit in Fig. 8, the CRC data is switched in Fig. 16. The 
CRC data D CRCX1 which is calculated by the microcom- 
puter 10 by the same method as the aforementioned is 
stored in the memory 32 of the system A and D CRCX2 is 
stored in the memory 33 continued to the memory 32. 
D CRCY i which is calculated by the microcomputer 11 is 
stored in the memory 42 of the system B and D CRCY2 is 
stored in the memory 43 continued to the memory 42. 
[0351 ] The CRC data is switched by the switching cir- 
cuits 204 and 205 using the failure detection signal 154 
and the sign inversion failure detection signal. Also in 
another embodiment of the present invention shown in 
Fig. 1 7, the number of memories requiring the maximum 
number of gates can be reduced by half, so that it not 
only greatly contributes to improvement of the reliability 
but also has a great effect on reduction of power con- 
sumption of the LSI. 

[0352] Fig. 18 shows another embodiment of the 
present invention. Fig. 18 also shows an example in 
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each switching circuit and then the output signal of each 
memory and the output signal of each switching circuit 
are added by the adder ; /. - v '■'•//*-. r • *; 

[0353] The switching circuit 34 of the system A switch- 
es the CRC data 32 and the CRC data 33 by the sign 
inversion failure detection signal 165 and the switching 
circuit 44 of the system B switches the CRC data 42 and 
the CRC data 43 by the failure detection signal 154. Also 
in another embodiment of the present invention shown 
in Fig. 18, the number of memories requiring the maxi- 
mum number of gates can be reduced by half and fur- 
thermore the number of adders also can be reduced by 
half, so that it not only greatly contributes to improve- 
ment of the reliability but also has a great effect on re- 
duction of power consumption of the LSI. 
[0354] Fig. 1 9 is a schematic layout diagram of anoth- 
er embodiment of the present invention shown in Fig. 8. 
Numeral 300 indicates a bus interface for transmitting 
and receiving data to or from the microcomputer 1 0, 301 
and 302 memories for storing data, 303 a processor 
such as a memory, switching circuit, a frequency con- 
verter, and a frequency comparator, 304 a bus interface 
for transmitting and receiving data to or from the micro- 
computer 11 , 305 and 306 memories for storing data, 

307 a processor such as a memory switching circuit, a 
frequency converter, and a frequency comparator, and 

308 a matcher for an output signal of the processor 303 
of the system A and an output signal of the processor 
307 of the system B. 

[0355] When the systems A and B are duplicated and 
arranged away from each other, an effect of a failure of 
one system on the other system, for example, an effect 
such that although one system is broken down, a signal 
as if it is normal is outputted can be prevented. 
[0356] When the circuits constituting the matcher unit 
are arranged away from each other and the conductor 
interval is extended, an effect such that a failure of one 
of the matchers affects the other matchers and a com- 
mand signal is not outputted or outputted can be pre- 
vented. 

[0357] Another embodiment of the present invention 
. is shown in Fig. 20 and will be explained hereunder. Fig. 
20 is a drawing showing an embodiment in which a plu- 
rality of processors which are the same as the one 
shown in Fig. 2 are provided. 

[0358] Numeral 2000 indicates a controller, 2010 a 
first processorf or inputting and processing first input da- 
ta and outputting first output data 2100 and a first de- 
tection signal 2140, 2020 a second processor for out- 
putting second output data 211 0 and a second detection 
signal 2150, 2030 a third processor for outputting third 
output data 21 20 and a third detection signal 21 60, 2040 
a fourth processor for outputting fourth output data 21 30 
and a fourth detection signal 21 70, 21 80 a first transmit- 
ter for transmitting the first detection signal 21 40 output- 
ted from the first processor 201 0 to the second proces- 
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r sof 2020, 21 90 a second transmitter for transmitting the : i • 
second detection signal 2150 outputted from the second - 
processor 2020 to the third processor 2030, and 2200 
a third transmitter for transmitting the third detection sig- 
nal 21 60 outputted from the third processor 2030 to the s 
fourth processor 2040. 

[0359] By using such a duplicated constitution that by 
using each failure detection signal, the CRC data of the 
corresponding detector is switched, only when all the 
data, circuits, and elements operate normally, an output io 
signal for controlling the object to be controlled is out- 
putted and when a failure is detected in a part, no output 
signal is outputted. Therefore, when a failure occurs, a 
fail safe function for controlling on the safety side is 
made possible. is- 
[0360] According to the present invention, as men- 
tioned above, a controller having an extremely high fail 
safe performance and a system using it can be realized. 
[0361] Further features of some or all embodiments 
of the present invention may be as described below in 20 
the remainder of this specification. 
[0362] In a first aspect, the invention may include a 
controller characterised in that said controller has a plu- 
rality of processors for inputting input signals and out- 
putting output signals obtained by executing a plurality 25 
of operations and inputs an output signal of a first proc- 
essor among said plurality of processors to second 
processors including at least one processor among said 
plurality of processors and inputs output signals of said 
second processors to said first processor and the polar- 30 
ity of one of said output signals of said second proces- 
sors is inverted to that of said input signals of said first 
processor. 

[0363] Preferably the invention includes a logic circuit 
or a controller 35 
wherein when one of said input signals of said first proc- 
essor makes a closed loop via said second processors, 
the polarity thereof is inverted. 

[0364] In a second aspect, the invention may include 
a controller characterized in that said controller has a *o 
first processor for inputting an input signal and output- 
ting an output signal obtained by executing a plurality of 
operations and a second processor for inputting an input 
signal and outputting an output signal obtained by exe- 
cuting a plurality of operations and inputs an output sig- 45 
nal of said first processor to said second processor and 
the polarity of one of output signals of said second proc- 
essor to be inputted to said first processor & inverted to 
that of said input signals to be inputted to said first proc- 
essor; 50 
[0365] Preferably the invention includes a controller 
wherein when one of said input signals to be inputted to 
said first processor makes a closed loop via said second 
processor, the polarity thereof is inverted. 
[0366] In a third aspect, the invention may include a 55 
controller characterised in that said controller comprises 
a first serial converter for converting a parallel input sig- 
nal to a serial signal, a first processor for processing an 



output signal of said first serial converter as arilriput sig- 
nal, a first parallel converter for converting a ferial but- 
put signal of said first processor to a parallel signal; a 
second serial converter for converting a parallel input 
signal to a serial signal, a second processor for process- 
ing an output signal of said second serial converter as 
an input signal, and a second parallel converter for con- 
verting a serial output signal of said second processor 
to a parallel signal and inputs one of output signals of 
said first parallel converter to said second serial convert- 
er for converting it serial signals together with other par- 
allel input signals and one of parallel input signals input- 
ted to said first serial converter inverts the polarity of one 
of output signals of said second parallel converterto that 
of other parallel input signals inputted to said first serial 
converter in the polarity inverter. 
[0367] Preferably the invention includes a controller 
wherein when one of said parallel input signals inputted 
to said first serial converter makes a closed loop via said 
second serial converter, said second processor, and 
said second parallel converter, the polarity thereof is in- 
verted to that of other parallel input signals inputted to 
said first serial converter. 

[0368] In a fourth aspect, the invention may include a 
controller characterized in that said controller comprises 
a plurality of input signals which are a group of signals 
inputted in parallel, a first multiplexer and a second mul- 
tiplexer for multiplexing said plurality of input signals to 
respective signals in time division, a first processor for 
processing a parallel output signal divided by said first 
multiplexer as an input signal, a first demultiplexer for 
integrating parallel output signals of said first processor 
which are divided in time, a second processor for 
processing a parallel output signal multiplexed by said 
second multiplexer as an input signal, and a second de- 
multiplexer for integrating parallel output signals of said 
second processor which are divided in time and inputs 
one of output signals of said first demultiplexer to said 
second multiplexer together with other signals which are 
inputted in parallel and one of signals which are inputted 
to said first multiplexer in parallel inverts the polarity of 
one of output signals of said second demultiplexer to 
that of other signals which are inputted to said first mul- 
tiplexer in parallel in the polarity inverter. 
[0369] Preferably the invention includes a controller 
wherein when one of input signals inputted to said first 
multiplexer makes a closed loop via said second multi- 
plexer, said second processor, and said second demul- 
tiplexer, the polarity thereof is inverted to that of said 
input signals inputted to said first multiplexer. 
[0370] In a fifth aspect, the invention may include a 
controller characterized in that said controller comprises 
a plurality of processors for executing a plurality of op- 
erations and an adder for adding one output signal of 
one processor of said plurality of processors and an op- 
tional value and inputs input signals to said plurality of 
processors respectively, inputs one of output signals of 
a first processor among said plurality of processors to a 
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■'*" second processor among said plurality of processors, 
inputs one of output signals of said second processor to 
said adder, and inputs an output signal of said adder to 
said first processor.: :. 

[0371 J In a sixth aspect, the invention may include a 
controller characterized in that said controller comprises 
a plurality of processors (N processors: N is a positive 
integer, 1,2,3, — ) for executing a plurality of operations 
and an adder for adding one output signal of said plu- 
rality of processors and an optional value and inputs in- 
put-signals to said plurality of processors respectively, 
inputs one of output signals of a processor of N=1 
among said plurality of processors to a processor of N=2 
among said plurality of processors, inputs sequentially 
like one of output signals of said processor of N=2 to a 
processor of N=3, inputs one of output signals of a proc- 
essor of N=N to said adder, and inputs an output signal 
of said adder to said first processor. 
[0372] In a seventh aspect, the invention may include 
a controller characterized in that said controller compris- 
es a first and a second processor for executing a plural- 
ity oLoperations, and an adder for adding one output 
signal of said first processor and an optional value, and 
a subtracter for subtracting an optional value from one 
output signal of said second processor and inputs input 
signals to said first processor and said second proces- 
sor respectively, inputs one of output signals of said first 
processor to said adder, inputs an output signal of said 
adder to said second processor, inputs one of output sig- 
nals of said second processor to said subtracter, and 
inputs an output signal of said subtracter to said first 
processor. 

[0373) In an eighth aspect, the invention may include 
a controller characterized in that said controller compris- 
es a plurality of processors (N processors: N is a positive 
integer, 1 , 2, 3, — ) for executing a plurality of operations, 
a plurality of adders (M adders: M is a positive integer, 
1,2,3,—) for adding one output signal of said plurality 
of processors and an optional value, and a subtracter 
for subtracting an optional value from one output signal 
of said plurality of processors and inputs input signals 
to said plurality of processors respectively, inputs one 
of output signals of a processor of N=1 among said plu- 
rality of processors to an adder of M=1 among said plu- 
rality of adders, inputs an output signal of said adder of 
M=1 to a processor of N=2 among said plurality of proc- 
essors, inputs an output signal of said adder of M=1 to 
a processor of N=2 among said plurality of processors, 
inputs one of output signals of a processor of N=2 
among said plurality of processors to an adder of M=2 
among said plurality of adders, inputs sequentially like 
ah output signal of said adder of M=2 to a processor of 
N=3 among said plurality of processors, inputs one of 
output signals of a processor of N=N among said plu- 
rality of processors to said subtracter, and inputs an out- 
put signal of said subtracter to said first processor 
among said plurality of processors. 
[0374] In a ninth aspect, the invention may include a 
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controller characterized in that said controller comprises;^^ 
a first serial converter for, converting a parallel input sig-^ 
nal to a serial signal, a first processor for processing an ; : i / "^''^ 
output signal of said first serial converter as an input sig-: ; . .:; : / r 
nal, a first parallel converter for converting a serial out— ' v v • 

put signal of said first processor to a parallel signal, a 
second serial converter for converting a parallel input 
signal to a serial signal, a second processor for process- - 
ing an output signal of said second serial converter as 
an input signal, and a second parallel converter for con^.. :: 
verting a serial output signal of said second processor 
to a parallel signal, a first status discrimination signal for 
discriminating the statuses of said first serial converter, 
said first processor, and said first parallel converter, a 
second status discrimination signal for discriminating 
the statuses of said second serial converter, said sec- 
ond processor, and said second parallel converter, a first 
failure detection signal for showing the statuses of said 
first serial converter, said first processor, and said first 
parallel converter by said first status discrimination sig- . 
nal, a second failure detection signal for showing the 
statuses of said second serial converter, said second 
processor, and said second parallel converter by said 
second status discrimination signal, a polarity inversion 
failure detection signal for inputting said second failure 
detection signal to a polarity inverter and inverting the 
output polarity of said second failure detection signal in 
said polarity inverter, a first adder for adding said first 
status discrimination signal and said polarity inversion 
failure detection signal, and a second adder for adding 
said second status discrimination signal and said first 
failure detection signal and inputs an output signal of 
said first adder to said first serial converter tog ether with 
said parallel input signal and inputs an output signal of 
said second adder to said second serial converter to- 
gether with said parallel input signal. 
[0375] In a tenth aspect, the invention may include a 
controller characterized in that said controller comprises 
a first processor for outputting a first output signal which 
is obtained by inputting and processing a first input sig- 
nal arid a first detection signal, a second processor for 
outputting a second output signal which is obtained by 
inputting and processing a second input signal and a 
second detection signal, a first transmitter for transmit- 
ting said first detection signal to said second processor, 
and a second transmitter for transmitting said second 
detection signal of said second processor to said first 
processor, and said second processor outputs said sec- 
ond detection signal on the basis of said first detection 
signal inputted via said first transmitter, and said second 
transmitter outputs said second polarity inversion detec- 
tion signal whose polarity is inverted to that of said first 
input signal to said first processor, and said first proces- 
sor outputs said first detection signal on the basis of said 
polarity inversion signal of said second transmitter. 
[0376] Preferably the invention includes a controller 
wherein said second transmitter has a logic unit for in- 
verting the polarity of said second detection signal out- 
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rial and said second output signal and outputting air 
ternating signals and changes or controls said CRC 
data of said second failure detector by said first fail- 
ure detection signal and changes or controls said 
CRC data of said first failure detector by said sec- 
ond failure detection signal. 

An ATP device according to Claim 1 , wherein a first 
signal line for transmitting a signal for changing said 
CRC data of said second failure detector by said 
first failure detection signal is connected between 
the output side of said first failure detector and the 
input side of said second failure detector and a sec- 
ond signal line for transmitting a signal for changing 
*s said CRC data of said first failure detector by said 
second failure detection signal is connected be- 
tween the output side of said second failure detector 
and the input side of said first failure detector. 

20 3. An ATP device according to Claim 2, wherein one 
of said first signal line and said second signal line 
has a logic circuit for inverting said first or second 
failure detection signal. 

25 4. An ATP device according to Claim 1 wherein said 
device further comprises a first microcomputer for 
being inputted of an ATP command speed signal for 
instructing the speed of an electric motor vehicle 
and generating first control data including at least 
30 two kinds of CRC data, a second microcomputer for 
being inputted of said ATP command speed signal 
and generating second control data including at 
least two kinds of CRC data, the first failure detector 
for checking said first control data inputted from said 
35 first microcomputer using one of said CRC data and 
outputting the first failure detection signal, the sec- 
ond failure detector for checking said second con- 
trol data inputted from said second microcomputer 
using one of said CRC data and outputting the sec- 
40 ond failure detection signaL and said CRC data of 
said second control data are changed or controlled 
by said first failure detection signal and said CRC 
data of said first control data are changed or con- 
trolled by said second failure detection signal. 
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5. An ATP device according to Claim 4, wherein a first 
signal line for transmitting a signal for changing said 
CRC data of said second failure detector by said 
first failure detection signal is connected between 
the output side of said first failure detector and the 
input side of said second failure detector and a sec- 
ond signal line for transmitting a signal for changing 
said CRC data of said first failure detector by said 
second failure detection signal is connected be- 
5 tween the output side of said second failure detector 
and the input side of said first failure detector. 



putted from said second processor to that of said first 
input signal. - 'V-, i>;y: . ^y'^y.'. 
[0377] Preferably, the invention includes a controller 
wherein said second processor has a logic unit for in- 
verting the polarity of said second detection signal proc- 
essed on the basis of said first detection signal to that 
of said first input signal. 

[0378] Preferably, the invention includes a controller 
wherein said first input signal or said second input signal 
has processing data of said first processor and said sec- 
ond processor and check data for checking the opera- 
tions of said first and second processors. 
[0379] Preferably, the invention includes a controller 
wherein the processing data of said input signal is the 
same as that of said second input signal. 
[0380] Preferably, the invention includes a controller 
wherein said check data checks the content of said first 
processing data or said second processing data. 
[0381] Preferably, the invention includes a controller 
wherein said first processor or said second processor 
has a logic unit for implementing logic for said first de- 
tection signal or said second detection signal and the 
check data of said input signal or said second input sig- 
nal. 



Claims 

1. An ATP device characterised in that said device 
comprises a first logic unit including a first failure 
detector for checking first control data including at 
least two kinds of CRC data according to an ATP 
command speed signal for instructing the speed of 
an electric motor vehicle using one of said CRC da- 
ta and outputting a first failure detection signal, a 
first frequency converter for converting said first 
control data to a first ATP command speed frequen- 
cy signal, and a first frequency comparator for com- 
paring a speed frequency signal in proportion to 
said detected speed of said electric motor vehicle 
and said first ATP command speed frequency signal 
and outputting a first output signal according to the 
deviation between said speed frequency signal and 
said first ATP command speed frequency signal, a 
second logic unit including a second failure detector 
for checking second control data including at least 
two kinds of CRC data according to said ATP com- 
mand speed signal using one of said CRC data and 
outputting a second failure detection signal, a sec- 
ond frequency converter for converting said second 
control data to a second ATP command speed fre- 
quency signal, and a second frequency comparator 
for comparing said speed frequency signal and said 
second ATP command speed frequency signal and 
outputting a second output signal according to the 
deviation between said speed frequency signal and 
said second ATC command speed frequency sig- 
nal, and a matcher for collating said first output sig- 



6. An ATP device according to Claim 5, wherein one 
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failure detection signal. 

; An ATP device according to Claim 4 wherein said 5 
device further comprises a generator which is in- : 
stalled outside an electric motor vehicle for gener- 
ating an ATP command speed signal for instructing 
the speed of said electric motor vehicle, a receiver 
which is installed inside said electric motor vehicle 10 
for receiving said ATP command speed signal from 
said generator, a speed detector which is installed 
inside said electric motor vehicle for detecting the 
speed of said electric motor vehicle and generating 
a speed frequency signal in proportion to said 15 
speed,. and the ATP device which is installed inside 
said electric motor vehicle for controlling the speed 
of said electric motor vehicle from said ATP com- 
mand speed signal and said speed frequency sig- 
nal, wherein the first microcomputer for being input- 20 
ted of said ATP command speed signal outputted 
from said receiver and generating the first control 
data including at least two kinds of CRC data, a sec- 
ond microcomputer for being inputted of said ATP 
command speed signal outputted from said receiver 25 
and generating the second control data including at 
least two kinds of CRC data, the first failure detector 
for checking said first control data inputted from said 
first microcomputer using one of said CRC data and 
outputting the first failure detection signal, the sec- 30 
ond failure detector for checking said second con- 
trol data inputted from said second microcomputer 
using one of said CRC data and outputting the sec- 
ond failure detection signal, the matcher for being 
inputted of said first failure detection signal, said 35 
first output signal, said second failure detection sig- 
nal, and said second output signal, collating said 
first output signal and said second output signal on 
the basis of said first and second failure detection 
signals, and outputting alternating signals in which *o 
said first output signal and said second output sig- 
nal alternate, and further comprises a braking de- 
vice which is installed inside said electric motor ve- 
hicle for inputting said alternating signals, control- 
ling the braking force, and driving the brake. 4 $ 

An ATP device according to Claim 7, wherein a first 
signal line fortransmitting a signal forchanging said 
CRC data of said second failure detector by said 
first failure detection signal is connected between so 
the output side of said first failure detector and the 
input side of said second failure detector and a sec- 
ond signal line for transmitting a signal for changing 
said CRC data of said first failure detector by said 
second failure detection signal is connected be- 55 
tween the output side of said failure second detector 
and the input side of said first failure detector. 



has a logic circuit for inverting said first or second 
detection signal. 

10. An ATP device according to Claim i wherein said 
device further comprises a first microcomputer for 
being inputted of an ATP command speed signal for 
instructing the speed of an electric motor vehicle 
and generating first control data with first CRC data 
added and second control data with second CRC 
data added, a second microcomputer for generat- 
ing third control data with third CRC data added and 
fourth control data with fourth CRC data added, the 
first logic unit further including a first memory for 
storing said first control data outputted from said 
first microcomputer, a second memory for storing 
said second control data, a first switching circuit for 
switching said first memory and said second mem- 
ory, a first failure detector and a second failure de- 
tector for checking output data of said first switching 
circuit, a first adder for adding said output data of 
said first switching circuit and an output signal of 
said second failure detector, a second adder for 
adding the speed frequency signal in proportion to 
the speed of said electric motor vehicle and an out- 
put signal of said first failure detector, the first fre- 
quency converter converts an output signal of said 
first adder to the ATP command speed frequency 
signal, and the first frequency comparator com- 
pares an output signal of said second adder and an 
output signal of said first frequency converter and 
outputting the first output signal and a first failure 
detection signal according to the deviation therebe- 
tween, the second logic unit further including a third 
memory for storing said third control data outputted 
from said second microcomputer, a fourth memory 
for storing said fourth control data, a second switch- 
ing circuit for switching said third memory and said 
fourth memory, a third failure detector and a fourth 
failure detector for checking output data of said sec- 
ond switching circuit, a third adder for adding said 
output data of said second switching circuit and an 
output signal of said fourth failure detector, a fourth 
adder for adding the speed frequency signal In pro- 
portion to the speed of said electric motor vehicle 
and an output signal of said third failure detector, 
the second frequency converter converts an output 
signal of said third adder to the ATP command 
speed frequency signal, and the second frequency 
comparator compares an output signal of said 
fourth adder and an output signal of said second 
frequency converter and outputting the second out- 
put signal and a second failure detection signal ac- 
cording to the deviation therebetween, and the 
matcher for collating said first output signal of said 
first logic unit, said second output signal of said sec- 
ond logic unit, said first failure detection signal, and 
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^ said second detection signal respectively and out- ? 
v . putting alternating signals, and said first failure de-; V 
: tection signal controls said second switching circuit 
and switches said third control data and said fourth 
control data and said second failure detection signal 5 
controls said first switching circuit and switches said 
first control data and said second control data. 

.11. An ATP device according to Claim 10, wherein said 

device has a logic circuit for inverting the polarity of io 
one of said second failure detection signal for con- 
trolling said first switching circuit and said first fail- 
ure detection signal for controlling said second 
switching circuit 

."- 15 

12. An ATP device according to Claim 1 0, wherein said 
first microcomputer generates said first control da- 
ta, said first CRC data for said first control data, and 
said second CRC data for said first control data 
when said ATP command speed signal for instruct- 20 
ing the speed of an electric motor vehicle is input- 
ted, and said second microcomputer generates 
said second control data, said third CRC data for 
said second control data, and said fourth CRC data 

for said second control data when said ATP com- 25 
mand speed signal for instructing the speed of an 
electric motor vehicle is inputted, and an output sig- 
nal of a fifth adder for adding said first control data 
and said first CRC data and an output signal of a 
sixth adder for adding said first control data and said 30 
second CRC data are inputted to said first switching 
circuit, and an output signal of a seventh adder for 
adding said second control data and said third CRC 
data and an output signal of an eighth adder for add- 
ing said second control data and said fourth CRC 35 
data are inputted to said second switching circuit. 

13. AN ATP device according to Claim 10, wherein said 
first microcomputer generates said first control data 
with said first CRC data and said second CRC data *o 
added when said ATP command speed signal for 
instructing the speed of an electric motor vehicle is 
inputted, and said second microcomputer gener- 
ates said second control data with said third CRC 
data and said fourth CRC data added when said 45 
ATP command speed signal for instructing the 
speed of an electric motor vehicle is inputted, and 
said first control data outputted from said first mi- 
crocomputer is stored in said first memory, and an 
output signal of said first memory is inputted to said 50 
first failure detector, said second failure detector, 
and said first adder, said second control data out- 
putted from said second microcomputer is stored in 
said second memory, and an output signal of-said 
second memory is inputted to said third failure de- 55 
tector, said fourth failure detector, and said third 
adder, and said second switching circuit switches 
said third CRC data and said fourth CRC data by 



said first failure detection signal;? and said first 
switching circuit switches" said first CRC data andu 
said second CRC data by said second failure de- 
tection signal- ; • V .•"./- * 

14. An ATP device according to Claim 1 0, wherein said 
first microcomputer generates the first control data, 
said first CRC data, and said second CRC data 
when said ATP command speed signal for instruct- 
ing the speed of an electric motor vehicle is input- 
ted, and said second microcomputer generates the 
second control data, said third CRC data, and said 
fourth CRC data when said ATP command speed 
signal for instructing the speed of an electric motor 
vehicle is inputted, and said first CRC data and said 
second CRC data are inputted to said first switching 
circuit, and an output signal of said first switching 
circuit and said first control data are added to a fifth 
adder, and said third CRC data and said fourth CRC 
data are inputted to said second switching circuit, 
and an output signal of said second switching circuit 
and said second control data are added to a sixth 
adder, and an output signal of said fifth adder is in- 
putted to said first adder, said first failure detector, 
and said second failure detector, and an output sig- 
nal of said sixth adder is inputted to said third adder, 
said third failure detector, and said fourth failure de- 
tector. 

15. An ATP device according to one of claims 1 to 14, 
wherein an accident diagnosis processing opera- 
tion is executed periodically after a parallel input 
signal is processed. 

16. A controller according to one of claims 1 to 14, 
wherein said input signal, said output signal, and 
said failure detection signal are alternating signals 
which alternate when said plurality of processors 
are ail normal. 

17. An ATP device according to one of claims 4, 7 and 
10, wherein said matcher collates said first output 
signal, said second output signal, said first failure 
detection signal, and said second failure detection 
signal, and when said first and second output sig- 
nals do not match with each other and said first and 
second failure detection signals do not match with 
each other, the alternation is stopped, and an emer- 
gency brake signal is outputted to said electric mo- 
tor vehicle by stopping of the alternation when said 
first and second failure detection signals do not 
match with each other. 
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(57) The object of the present invention is to provide 
a controller and a system having a highly reliable fail 
safe function. An ATP device which generates control 
data for the two systems from an ATP command speed 
signal, duplicates the logic unit in the ATP device so as 
to process each control data, provides at least two CRC 
data for checking the control data for each system, and 
changes the CRC data of the opposite logic units or se- 
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iects one of the two according to the content of a failure 
detection signal from each of the duplicated logic units. 
It is realized to check the control data and the operation 
of each logic circuit and only when all the data, circuits, 
and elements operate normally, an output signal for con- 
trolling the object to be controlled is outputted and when 
a failure is detected in a part, an output signal is output- 
ted. Therefore, when a failure occurs, a fail safe function 
for controlling on the safety side is made possible. 
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